{"id":"ASB-A-366401629","details":"In isSafeIntent of AccountManagerService.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-366401629","CVE-2025-0091"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/e3bbc415adb51975aeade545725b6931099d412e"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-02-01"}]}],"versions":["15-next"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"updatePreferenceIntents"},"deprecated":false,"digest":{"length":1377,"function_hash":"338350863036102985394706704282023021029"},"id":"ASB-A-366401629-7bd8169a","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["275136482310096949223314165621352716840","8115445310509100908857167739662128042","253441721171165215243821755830095971678","88776566412728272429447891863167717932","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"id":"ASB-A-366401629-97f8a3b3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"}},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"onPreferenceClick"},"deprecated":false,"digest":{"length":379,"function_hash":"249159885145870363150402675264162571837"},"id":"ASB-A-366401629-a646b22c","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-366401629-e1ee7f63","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"isSafeIntent"},"deprecated":false,"digest":{"function_hash":"39329553774310626754490354329580384782","length":539}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801"],"severity":"High","spl":"2025-02-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2025-02-01"}]}],"versions":["12"],"ecosystem_specific":{"severity":"High","spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"onPreferenceClick"},"deprecated":false,"digest":{"length":322,"function_hash":"205161867117239727942345407947753384515"},"id":"ASB-A-366401629-3ee63a8b","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"updatePreferenceIntents"},"deprecated":false,"digest":{"length":1306,"function_hash":"320241958175093881091290427079770006414"},"id":"ASB-A-366401629-4b373237"},{"id":"ASB-A-366401629-b3430fb8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"function":"isSafeIntent","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"length":539,"function_hash":"39329553774310626754490354329580384782"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"line_hashes":["293101183722590943478867740640679466749","108412991053796078583091860813531505642","28035893926855174962940746953580967671","40112860432468891969057084409714236080","177480183194004016276858230791931740979","172276761039711939950469013439173632504","101497221201453250963401664882264014271","38057727491844513664265555579356222181","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"id":"ASB-A-366401629-edaa9324","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2025-02-01"}]}],"versions":["12L"],"ecosystem_specific":{"severity":"High","spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"320241958175093881091290427079770006414","length":1306},"id":"ASB-A-366401629-366b753b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"function":"updatePreferenceIntents","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"line_hashes":["293101183722590943478867740640679466749","108412991053796078583091860813531505642","28035893926855174962940746953580967671","40112860432468891969057084409714236080","177480183194004016276858230791931740979","172276761039711939950469013439173632504","101497221201453250963401664882264014271","38057727491844513664265555579356222181","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"id":"ASB-A-366401629-56658158"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"isSafeIntent"},"deprecated":false,"digest":{"function_hash":"39329553774310626754490354329580384782","length":539},"id":"ASB-A-366401629-583296b6","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"length":322,"function_hash":"205161867117239727942345407947753384515"},"id":"ASB-A-366401629-d7812ae8"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-02-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"isSafeIntent"},"deprecated":false,"digest":{"function_hash":"39329553774310626754490354329580384782","length":539},"id":"ASB-A-366401629-08136352","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"line_hashes":["275136482310096949223314165621352716840","8115445310509100908857167739662128042","253441721171165215243821755830095971678","88776566412728272429447891863167717932","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"id":"ASB-A-366401629-21bb3464","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"updatePreferenceIntents"},"deprecated":false,"digest":{"function_hash":"338350863036102985394706704282023021029","length":1377},"id":"ASB-A-366401629-e1812b4e","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"function_hash":"249159885145870363150402675264162571837","length":379},"id":"ASB-A-366401629-ef63506c","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659"],"severity":"High","spl":"2025-02-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-02-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"line_hashes":["293101183722590943478867740640679466749","108412991053796078583091860813531505642","28035893926855174962940746953580967671","40112860432468891969057084409714236080","177480183194004016276858230791931740979","172276761039711939950469013439173632504","101497221201453250963401664882264014271","38057727491844513664265555579356222181","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"id":"ASB-A-366401629-14226ff4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"},{"id":"ASB-A-366401629-175a338c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"isSafeIntent"},"deprecated":false,"digest":{"function_hash":"39329553774310626754490354329580384782","length":539}},{"deprecated":false,"digest":{"function_hash":"205161867117239727942345407947753384515","length":322},"id":"ASB-A-366401629-40363280","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"onPreferenceClick"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"updatePreferenceIntents"},"deprecated":false,"digest":{"length":1306,"function_hash":"320241958175093881091290427079770006414"},"id":"ASB-A-366401629-d22a7bdd","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"],"severity":"High","spl":"2025-02-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-02-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-02-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"updatePreferenceIntents"},"deprecated":false,"digest":{"length":1377,"function_hash":"338350863036102985394706704282023021029"},"id":"ASB-A-366401629-084c4570","signature_type":"Function"},{"id":"ASB-A-366401629-24cbf0d0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"length":379,"function_hash":"249159885145870363150402675264162571837"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"deprecated":false,"digest":{"line_hashes":["275136482310096949223314165621352716840","8115445310509100908857167739662128042","253441721171165215243821755830095971678","88776566412728272429447891863167717932","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"id":"ASB-A-366401629-4372bfae","signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java","function":"isSafeIntent"},"deprecated":false,"digest":{"function_hash":"39329553774310626754490354329580384782","length":539},"id":"ASB-A-366401629-ff19356c","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}}],"schema_version":"1.9.0"}