{"id":"ASB-A-366401629","details":"In isSafeIntent of AccountManagerService.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-366401629","CVE-2025-0091"],"modified":"2026-04-24T15:37:38.793646Z","published":"2025-02-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-02-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/e3bbc415adb51975aeade545725b6931099d412e"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-02-01"}]}],"versions":["15-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"function":"updatePreferenceIntents","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":1377,"function_hash":"338350863036102985394706704282023021029"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-7bd8169a"},{"target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Line","digest":{"line_hashes":["275136482310096949223314165621352716840","8115445310509100908857167739662128042","253441721171165215243821755830095971678","88776566412728272429447891863167717932","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-97f8a3b3"},{"target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":379,"function_hash":"249159885145870363150402675264162571837"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-a646b22c"},{"target":{"function":"isSafeIntent","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":539,"function_hash":"39329553774310626754490354329580384782"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-e1ee7f63"}],"spl":"2025-02-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/841fb3846b25dee4ae5924fd798cd48709c69801"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2025-02-01"}]}],"versions":["12"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":322,"function_hash":"205161867117239727942345407947753384515"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-3ee63a8b"},{"target":{"function":"updatePreferenceIntents","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":1306,"function_hash":"320241958175093881091290427079770006414"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-4b373237"},{"target":{"function":"isSafeIntent","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":539,"function_hash":"39329553774310626754490354329580384782"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-b3430fb8"},{"target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Line","digest":{"line_hashes":["293101183722590943478867740640679466749","108412991053796078583091860813531505642","28035893926855174962940746953580967671","40112860432468891969057084409714236080","177480183194004016276858230791931740979","172276761039711939950469013439173632504","101497221201453250963401664882264014271","38057727491844513664265555579356222181","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-edaa9324"}],"spl":"2025-02-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2025-02-01"}]}],"versions":["12L"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"function":"updatePreferenceIntents","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":1306,"function_hash":"320241958175093881091290427079770006414"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-366b753b"},{"target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Line","digest":{"line_hashes":["293101183722590943478867740640679466749","108412991053796078583091860813531505642","28035893926855174962940746953580967671","40112860432468891969057084409714236080","177480183194004016276858230791931740979","172276761039711939950469013439173632504","101497221201453250963401664882264014271","38057727491844513664265555579356222181","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-56658158"},{"target":{"function":"isSafeIntent","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":539,"function_hash":"39329553774310626754490354329580384782"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-583296b6"},{"target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":322,"function_hash":"205161867117239727942345407947753384515"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-d7812ae8"}],"spl":"2025-02-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-02-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"function":"isSafeIntent","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":539,"function_hash":"39329553774310626754490354329580384782"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-08136352"},{"target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Line","digest":{"line_hashes":["275136482310096949223314165621352716840","8115445310509100908857167739662128042","253441721171165215243821755830095971678","88776566412728272429447891863167717932","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-21bb3464"},{"target":{"function":"updatePreferenceIntents","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":1377,"function_hash":"338350863036102985394706704282023021029"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-e1812b4e"},{"target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":379,"function_hash":"249159885145870363150402675264162571837"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-ef63506c"}],"spl":"2025-02-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4929f6647b4d99d88423d0b3abac692112fde659"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-02-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Line","digest":{"line_hashes":["293101183722590943478867740640679466749","108412991053796078583091860813531505642","28035893926855174962940746953580967671","40112860432468891969057084409714236080","177480183194004016276858230791931740979","172276761039711939950469013439173632504","101497221201453250963401664882264014271","38057727491844513664265555579356222181","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-14226ff4"},{"target":{"function":"isSafeIntent","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":539,"function_hash":"39329553774310626754490354329580384782"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-175a338c"},{"target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":322,"function_hash":"205161867117239727942345407947753384515"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-40363280"},{"target":{"function":"updatePreferenceIntents","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":1306,"function_hash":"320241958175093881091290427079770006414"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-d22a7bdd"}],"spl":"2025-02-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d782f9c4bc72cdb0dbfb07a76e1582dafa9f49b3"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-02-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"function":"updatePreferenceIntents","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":1377,"function_hash":"338350863036102985394706704282023021029"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-084c4570"},{"target":{"function":"onPreferenceClick","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":379,"function_hash":"249159885145870363150402675264162571837"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-24cbf0d0"},{"target":{"file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Line","digest":{"line_hashes":["275136482310096949223314165621352716840","8115445310509100908857167739662128042","253441721171165215243821755830095971678","88776566412728272429447891863167717932","291181340016329943787835484543735978002","337055358763802024687632734263119858537","144527641339476917381900104948976199380","288804223690381204920515188312016379424","321282692846684833123748020644360983800","92202846900541558230823896526142212141","142522869818369563026579756524167146678","99985113270951985539927909697017026260","46167360946225016189541062569585315829","21482840765400729961458176275511083467","10483233878163130821033715343137177339","50912571117168118554999577203142604775"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-4372bfae"},{"target":{"function":"isSafeIntent","file":"src/com/android/settings/accounts/AccountTypePreferenceLoader.java"},"signature_type":"Function","digest":{"length":539,"function_hash":"39329553774310626754490354329580384782"},"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a","signature_version":"v1","deprecated":false,"id":"ASB-A-366401629-ff19356c"}],"spl":"2025-02-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/8fa1dcb0345a2f5f751a465c208aa496f7be642a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-366401629.json"}}],"schema_version":"1.7.5"}