{"id":"ASB-A-365739560","details":"In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check  due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-365739560","CVE-2025-32326"],"modified":"2026-09-04T15:10:05.031284235Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/e12156e2d805c492f01f1d218a1e840a03edbddb"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"139833213286453817508976882185220600292","length":451},"id":"ASB-A-365739560-80b180df","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d3e34060803c97ae05719fe9301026e5c54892c8","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d3e34060803c97ae05719fe9301026e5c54892c8","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"onReceive"},"deprecated":false,"digest":{"function_hash":"44664639594184004527381814604213714195","length":923},"id":"ASB-A-365739560-e151e87f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d3e34060803c97ae05719fe9301026e5c54892c8","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["226258992788408103768241656125646477489","151749678647308287184408583869206112276","32874708126785652610071324256384515293","142720510984991299874127682360591830670","238594068523129572717643131955295196712","65439622675099890104196857984663533821","32149523897884140014765625018284241268","31745228343486687015715975030408161151","285861665528246234849188350692803170265","195505780198854931865378430470304767688","30620144862055094913309642984484790709","172038091581725465188235125294497104040","332676715799252123219664180927578214086","256864482524894738248441823773669892375","152756306830895543643303987982768735873","83011365851368182460669908916017953360","320351620476754738044930245546768903412","70599665159709680621007106450376463716"],"threshold":0.9},"id":"ASB-A-365739560-f4415227","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d3e34060803c97ae05719fe9301026e5c54892c8"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365739560.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/624c2490780677f9dc2002318a9932ce406f056b"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/624c2490780677f9dc2002318a9932ce406f056b","target":{"function":"onReceive","file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"function_hash":"44664639594184004527381814604213714195","length":923},"id":"ASB-A-365739560-3124d45d"},{"digest":{"length":451,"function_hash":"139833213286453817508976882185220600292"},"id":"ASB-A-365739560-bd8a77fe","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/624c2490780677f9dc2002318a9932ce406f056b","target":{"function":"assertSafeToStartCustomActivity","file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/624c2490780677f9dc2002318a9932ce406f056b","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["226258992788408103768241656125646477489","151749678647308287184408583869206112276","32874708126785652610071324256384515293","142720510984991299874127682360591830670","238594068523129572717643131955295196712","65439622675099890104196857984663533821","32149523897884140014765625018284241268","31745228343486687015715975030408161151","285861665528246234849188350692803170265","195505780198854931865378430470304767688","30620144862055094913309642984484790709","172038091581725465188235125294497104040","332676715799252123219664180927578214086","256864482524894738248441823773669892375","152756306830895543643303987982768735873","83011365851368182460669908916017953360","320351620476754738044930245546768903412","70599665159709680621007106450376463716"],"threshold":0.9},"id":"ASB-A-365739560-e3e092c9"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365739560.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-365739560-2bd3c7ee","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/586422578de58f1da68fd9becf89a08ea2ae0058","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false,"digest":{"length":451,"function_hash":"139833213286453817508976882185220600292"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/586422578de58f1da68fd9becf89a08ea2ae0058","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"onReceive"},"deprecated":false,"digest":{"function_hash":"44664639594184004527381814604213714195","length":923},"id":"ASB-A-365739560-7b6121e9","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/586422578de58f1da68fd9becf89a08ea2ae0058","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["226258992788408103768241656125646477489","151749678647308287184408583869206112276","32874708126785652610071324256384515293","142720510984991299874127682360591830670","238594068523129572717643131955295196712","65439622675099890104196857984663533821","32149523897884140014765625018284241268","31745228343486687015715975030408161151","285861665528246234849188350692803170265","195505780198854931865378430470304767688","30620144862055094913309642984484790709","172038091581725465188235125294497104040","332676715799252123219664180927578214086","256864482524894738248441823773669892375","152756306830895543643303987982768735873","83011365851368182460669908916017953360","320351620476754738044930245546768903412","70599665159709680621007106450376463716"],"threshold":0.9},"id":"ASB-A-365739560-a371fcaf"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/586422578de58f1da68fd9becf89a08ea2ae0058"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365739560.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"44664639594184004527381814604213714195","length":923},"id":"ASB-A-365739560-21985fbf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52a681c81503ef10dca1d7fc01d83a1925c256b9","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"onReceive"}},{"deprecated":false,"digest":{"length":451,"function_hash":"139833213286453817508976882185220600292"},"id":"ASB-A-365739560-8e77647f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52a681c81503ef10dca1d7fc01d83a1925c256b9","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"}},{"id":"ASB-A-365739560-afe0d2cb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/52a681c81503ef10dca1d7fc01d83a1925c256b9","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["226258992788408103768241656125646477489","151749678647308287184408583869206112276","32874708126785652610071324256384515293","142720510984991299874127682360591830670","238594068523129572717643131955295196712","65439622675099890104196857984663533821","32149523897884140014765625018284241268","31745228343486687015715975030408161151","285861665528246234849188350692803170265","195505780198854931865378430470304767688","30620144862055094913309642984484790709","172038091581725465188235125294497104040","332676715799252123219664180927578214086","256864482524894738248441823773669892375","152756306830895543643303987982768735873","83011365851368182460669908916017953360","320351620476754738044930245546768903412","70599665159709680621007106450376463716"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/52a681c81503ef10dca1d7fc01d83a1925c256b9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365739560.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4b380a97ede6c40299da3e6637f4c25452237bf9","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false,"digest":{"length":451,"function_hash":"139833213286453817508976882185220600292"},"id":"ASB-A-365739560-041a61df","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4b380a97ede6c40299da3e6637f4c25452237bf9","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"onReceive"},"deprecated":false,"digest":{"function_hash":"44664639594184004527381814604213714195","length":923},"id":"ASB-A-365739560-2edf8beb","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226258992788408103768241656125646477489","151749678647308287184408583869206112276","32874708126785652610071324256384515293","142720510984991299874127682360591830670","238594068523129572717643131955295196712","65439622675099890104196857984663533821","32149523897884140014765625018284241268","31745228343486687015715975030408161151","285861665528246234849188350692803170265","195505780198854931865378430470304767688","30620144862055094913309642984484790709","172038091581725465188235125294497104040","332676715799252123219664180927578214086","256864482524894738248441823773669892375","152756306830895543643303987982768735873","83011365851368182460669908916017953360","320351620476754738044930245546768903412","70599665159709680621007106450376463716"]},"id":"ASB-A-365739560-85b8826c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4b380a97ede6c40299da3e6637f4c25452237bf9","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4b380a97ede6c40299da3e6637f4c25452237bf9"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-365739560.json"}}],"schema_version":"1.9.0"}