{"id":"ASB-A-364604008","details":"In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-364604008","CVE-2025-22425"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/8575592802b9527fe0f7cf19e9cb7159c9aa5121"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/942884abf148426e948774b4857052da77ef77b3"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java","function":"startInstallConfirm"},"deprecated":true,"digest":{"function_hash":"7486587462945499067505919424238067578","length":861},"id":"ASB-A-364604008-0474f80d","match_only_versions":["15-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a7d97bda782673495e835fbb6270feaf9597180"},{"deprecated":true,"digest":{"threshold":0.9,"line_hashes":["239997872627874013858094228698209417007","300560494199847448088526710286033350270","169171816291862552234693659554921055773","106448833248763005298417009811583939818","80402524279856093431934567631564533961","188968601301982497144155558497161622873","112183593866621171201058879104057184985","76856515010416961148893360395432469862","231492191725931531989992910806370570774","37860944525313294179293970861117265202","105889057429397928333764303811239258112","203366793238726903225981038632273095188","183350456094849159843147892814634368189","215162686455127551274573569804614842798","319682258086045406161293611486580939484","89030476593110646679244023066713007967","129022751262284482060101170413022318575","142108707331754185169244718969550489997","149615220959517875262878727504610801315","331865057982459999787924051592288682331","210702291394037450745423228377193053886","317301210071067071463842832389382006059","312512817885817320178268735367237585957","326702651178785960699345090466889261000","212078848434562354481241657621732402848","34432965841682667441171968492533093943","154492253934249028128615976745958037697","198944113901287399059663197198538352804","135632183647876911202643531513991418766","161894315159094774138135058947717393537","164180158681974992275357555371845133840","205849357078047806163747476387265443401","216290201132826407393799513463018435786","234078774792100681781948389887267773276","18326714257772092878067741751931681479","305150778758476825010463190486205378522","219282165031923552758700841273731630418","293519393355592805934594586590596076008","121510656556329415618416847652468413184","18564320280153405040341546775533413989","14253042620362463953716722532530580043","169414281394896812645472734885602830429","320555653234863025471957763588781148388","258733265859905578489350088296979353759","212060202995027912623088708601474712238","292576631868066960383461394818810351116","264541345511356247042364960583776622975","334761386435526908824927085407066241970","292790597249375473805884463488143864530","67656165468126002143123327815485927534","335271927265368326427630924007568819625","238832771691467392684803080623683959812","192061125160132623300057569945296028801","316072279395810722330343438429232874756","235959147268814802703646199539065233430","233305655050365011585775405190596783696","337887763178971375968549250626409753371","63264643558389077870299092262795115499","339046339663935988604334305529227064051","190454121127996190109010957416874027380","133706322281834933619665727774070907123","31028462738914808354434616777774951134","25952484280898252138134577163741291572","174123767076359793663654312915308103951","146033564117295032691881346265760821965","41583079700771000418413731482411156169","206955656759103573431883831380592688184"]},"id":"ASB-A-364604008-1cf417c1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a7d97bda782673495e835fbb6270feaf9597180","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a7d97bda782673495e835fbb6270feaf9597180","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java","function":"onCreate"},"deprecated":true,"digest":{"function_hash":"85312498887412952791068794335721263168","length":4785},"id":"ASB-A-364604008-65324717","signature_type":"Function"},{"deprecated":true,"digest":{"length":2833,"function_hash":"222478381897983099997134747460449872384"},"id":"ASB-A-364604008-c7dbf15e","match_only_versions":["15-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a7d97bda782673495e835fbb6270feaf9597180","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8a7d97bda782673495e835fbb6270feaf9597180","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java"},"deprecated":true,"digest":{"line_hashes":["43495188763178189494773477946847554127","171452365742958275829128311732507227691","188771984679285075682615590446203016827","27607564790075904911361698710191035097","284507449734651550468705710898641347423","88846106759710428147523017494034919965","76110384732505814510881821842471510490","292495715245602770372048188780292147938","62722030675101398929839314022149158070","172108193023764383135491694976441790696","319962182219015922029059513340172987904","336457682676638563642197157531488018537","172752325023486928825348409859733787235","6157770973365688787749605181257328184","187804038356483533550346126106994151707","157599809173621837895117781965561247002","257863060811533030262044650618977178764","338425554533670872743838266101178923424","313601947050687158782726741354362693175","84391541946795575679525113791358086374","334836790809163341086652160940327696733","264175881596790146581171783547207901424","5462834487521836454894472053567293735","3454683831540289422511886444442881160","109930775097057437623292319666152070447"],"threshold":0.9},"id":"ASB-A-364604008-e8665f40"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8a7d97bda782673495e835fbb6270feaf9597180"],"severity":"High","spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-364604008.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-05-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"target":{"function":"isSystemDownloadsProvider","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"deprecated":false,"digest":{"function_hash":"26200279827331317583335015096020339787","length":242},"id":"ASB-A-364604008-278d06b6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7df6cd018351eda442bf1f13016356b14a7441bc"},{"target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java","function":"getSourceInfo"},"deprecated":false,"digest":{"length":195,"function_hash":"161749173966551971986502944187345603450"},"id":"ASB-A-364604008-30677269","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7df6cd018351eda442bf1f13016356b14a7441bc"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7df6cd018351eda442bf1f13016356b14a7441bc","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["182550138596758404138546365105514214192","218417926596773574409069406401153800559","246347022106945538213948940810704830545","89521379274627772360647602170702179097","74942993132053283119738422288911345405","195721500790157643145400836037650591624","83613078623110867480685453263579891618","124468737065782722131160012936446800357","248430809898026063774551970670526444011","155520250516721227270082128043581869817","96452572838718375624340289415209726863","101826152418611478049262205437471983049","327505783506833456706590242279116109554","268942618144006615514578817372527825028","219442301875325305408581043581032379107","306829863749940073448630730749654581202","295039290818669033090153174036326952398","337382750033468954389215070007128526865","294125733681145534992500423528000180348","64309009610229221464944689610468863562","287613036503791711189731675298368446715","22403970922438975414857445319444967964","230899908479268753580149716451603741134"]},"id":"ASB-A-364604008-89081133","signature_type":"Line"},{"id":"ASB-A-364604008-a1dfff2a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/7df6cd018351eda442bf1f13016356b14a7441bc","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"deprecated":false,"digest":{"function_hash":"186829648395529704516892033729437985195","length":2435}},{"target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"deprecated":false,"digest":{"line_hashes":["240145883228784504687270205886705453923","300560494199847448088526710286033350270","171407789740181329243412143023426468761","143112615348920700088193026269644485811"],"threshold":0.9},"id":"ASB-A-364604008-c6b37a25","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ad24e3161de939da72408a5309d6d11551fbb8c9"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ad24e3161de939da72408a5309d6d11551fbb8c9","https://android.googlesource.com/platform/frameworks/base/+/7df6cd018351eda442bf1f13016356b14a7441bc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-364604008.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ad24e3161de939da72408a5309d6d11551fbb8c9","https://android.googlesource.com/platform/frameworks/base/+/9c1bdd6325e9bc306e78a1d3426941036d68cedc"],"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9c1bdd6325e9bc306e78a1d3426941036d68cedc","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java","function":"onCreate"},"deprecated":false,"digest":{"length":3869,"function_hash":"205447451239911474883128703020172321151"},"id":"ASB-A-364604008-05592222"},{"target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["182550138596758404138546365105514214192","218417926596773574409069406401153800559","246347022106945538213948940810704830545","89521379274627772360647602170702179097","139514748923737517055472812719130255369","55119060336932247334489881240965292498","83613078623110867480685453263579891618","124468737065782722131160012936446800357","248430809898026063774551970670526444011","155520250516721227270082128043581869817","96452572838718375624340289415209726863","101826152418611478049262205437471983049","327505783506833456706590242279116109554","268942618144006615514578817372527825028","316893008860389476158908409581924925237","306829863749940073448630730749654581202","295039290818669033090153174036326952398","337382750033468954389215070007128526865","294125733681145534992500423528000180348","278779395994007466754297421455647015102","287613036503791711189731675298368446715","22403970922438975414857445319444967964","230899908479268753580149716451603741134"]},"id":"ASB-A-364604008-2c863499","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9c1bdd6325e9bc306e78a1d3426941036d68cedc"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["240145883228784504687270205886705453923","300560494199847448088526710286033350270","171407789740181329243412143023426468761","143112615348920700088193026269644485811"]},"id":"ASB-A-364604008-80e372e7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ad24e3161de939da72408a5309d6d11551fbb8c9","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"}},{"digest":{"function_hash":"161749173966551971986502944187345603450","length":195},"id":"ASB-A-364604008-babe2d4f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9c1bdd6325e9bc306e78a1d3426941036d68cedc","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java","function":"getSourceInfo"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9c1bdd6325e9bc306e78a1d3426941036d68cedc","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java","function":"isSystemDownloadsProvider"},"deprecated":false,"digest":{"length":266,"function_hash":"326063410276924829768664860705560200947"},"id":"ASB-A-364604008-f9c7ef32"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-364604008.json"}}],"schema_version":"1.9.0"}