{"id":"ASB-A-368579654","details":"In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-368579654","CVE-2025-22427"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/7255b2eaac4b5cb1bc3bbf23509b33c7355a8657"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"severity":"High","spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":150,"function_hash":"152491628019347033603108498272129690993"},"id":"ASB-A-368579654-a8796688","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e0510a62eba04140e459cdd8232f35087aa3073b","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onResume"}},{"digest":{"line_hashes":["182406899371089276968772861962409962225","18667552456110097476006100751115697760","58556086388370174162335450170874195399","82223097250831989202073821678705009138","278580168040252423585676024963933112499","185994664878209836163354010463277212969","313510924206706034109978639283945300260","10483646070535809996839636999891958416","280101618976838517571389457581797782146","110397190611182553138128194454172647694","277360658493102168218717805717606365827","102713302900656141844023384942279959637","306858075372273438258919299450667223789","212352700153393542678356668804643101829","59776608235116714015936706412046134471","302237659860109888592571963495401023936","203222567798565149871069076554845286579","285658978204143824377573422968042470976","310019452172566304540818858299454229364"],"threshold":0.9},"id":"ASB-A-368579654-c34e7e7b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e0510a62eba04140e459cdd8232f35087aa3073b","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java"},"deprecated":false},{"id":"ASB-A-368579654-ff916a21","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/e0510a62eba04140e459cdd8232f35087aa3073b","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onPause"},"deprecated":false,"digest":{"function_hash":"154103499203376154732330182285847602469","length":150}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/e0510a62eba04140e459cdd8232f35087aa3073b"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-368579654.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"152491628019347033603108498272129690993","length":150},"id":"ASB-A-368579654-186be376","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4b2cf3f23788ec210863757217ead902ee1f3bb4","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onResume"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["182406899371089276968772861962409962225","18667552456110097476006100751115697760","58556086388370174162335450170874195399","82223097250831989202073821678705009138","278580168040252423585676024963933112499","185994664878209836163354010463277212969","313510924206706034109978639283945300260","10483646070535809996839636999891958416","280101618976838517571389457581797782146","110397190611182553138128194454172647694","277360658493102168218717805717606365827","102713302900656141844023384942279959637","306858075372273438258919299450667223789","212352700153393542678356668804643101829","59776608235116714015936706412046134471","302237659860109888592571963495401023936","203222567798565149871069076554845286579","285658978204143824377573422968042470976","310019452172566304540818858299454229364"]},"id":"ASB-A-368579654-db4d9030","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4b2cf3f23788ec210863757217ead902ee1f3bb4","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java"},"deprecated":false},{"digest":{"length":150,"function_hash":"154103499203376154732330182285847602469"},"id":"ASB-A-368579654-df0f68be","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4b2cf3f23788ec210863757217ead902ee1f3bb4","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onPause"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4b2cf3f23788ec210863757217ead902ee1f3bb4"],"severity":"High","spl":"2025-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-368579654.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-368579654-2c1bfbdf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/2a6672dd33d6430da0f240fd600f7379ac301588","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onResume"},"deprecated":false,"digest":{"function_hash":"152491628019347033603108498272129690993","length":150}},{"target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java"},"deprecated":false,"digest":{"line_hashes":["182406899371089276968772861962409962225","18667552456110097476006100751115697760","58556086388370174162335450170874195399","44112267781912914714274056490075461669","278580168040252423585676024963933112499","185994664878209836163354010463277212969","313510924206706034109978639283945300260","10483646070535809996839636999891958416","280101618976838517571389457581797782146","110397190611182553138128194454172647694","277360658493102168218717805717606365827","102713302900656141844023384942279959637","306858075372273438258919299450667223789","212352700153393542678356668804643101829","59776608235116714015936706412046134471","302237659860109888592571963495401023936","203222567798565149871069076554845286579","285658978204143824377573422968042470976","310019452172566304540818858299454229364"],"threshold":0.9},"id":"ASB-A-368579654-900718d2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/2a6672dd33d6430da0f240fd600f7379ac301588"},{"id":"ASB-A-368579654-d389a588","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/2a6672dd33d6430da0f240fd600f7379ac301588","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onPause"},"deprecated":false,"digest":{"length":150,"function_hash":"154103499203376154732330182285847602469"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/2a6672dd33d6430da0f240fd600f7379ac301588"],"severity":"High","spl":"2025-04-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-368579654.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c97cd9e805f9c347db5152553fdd1c4004a558b3"],"severity":"High","spl":"2025-04-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c97cd9e805f9c347db5152553fdd1c4004a558b3","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java"},"deprecated":false,"digest":{"line_hashes":["182406899371089276968772861962409962225","18667552456110097476006100751115697760","58556086388370174162335450170874195399","44112267781912914714274056490075461669","278580168040252423585676024963933112499","185994664878209836163354010463277212969","313510924206706034109978639283945300260","10483646070535809996839636999891958416","280101618976838517571389457581797782146","110397190611182553138128194454172647694","277360658493102168218717805717606365827","102713302900656141844023384942279959637","306858075372273438258919299450667223789","212352700153393542678356668804643101829","59776608235116714015936706412046134471","302237659860109888592571963495401023936","203222567798565149871069076554845286579","285658978204143824377573422968042470976","310019452172566304540818858299454229364"],"threshold":0.9},"id":"ASB-A-368579654-83d1c687"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c97cd9e805f9c347db5152553fdd1c4004a558b3","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onPause"},"deprecated":false,"digest":{"function_hash":"154103499203376154732330182285847602469","length":150},"id":"ASB-A-368579654-9c35dc5f","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c97cd9e805f9c347db5152553fdd1c4004a558b3","target":{"file":"src/com/android/settings/notification/NotificationAccessConfirmationActivity.java","function":"onResume"},"deprecated":false,"digest":{"function_hash":"152491628019347033603108498272129690993","length":150},"id":"ASB-A-368579654-cb7e3db0"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-368579654.json"}}],"schema_version":"1.9.0"}