{"id":"ASB-A-379362792","details":"In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local escalation of privilege on versions of Android where android.permission.MANAGE_DEFAULT_APPLICATIONS was not defined with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-379362792","CVE-2025-26425"],"modified":"2026-04-17T15:55:28.020024Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Permission/+/850ce9ea3ac72540ce310722633d9c893a32dfdd"}],"affected":[{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"spl":"2025-05-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/59675001a55932c51c97d61e303ed2233d5fcb33"],"vanir_signatures":[{"digest":{"length":703,"function_hash":"172422290243571136857020070158254145359"},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/59675001a55932c51c97d61e303ed2233d5fcb33","signature_type":"Function","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-09721951","target":{"function":"getDefaultApplicationAsUser","file":"service/java/com/android/role/RoleService.java"}},{"digest":{"line_hashes":["234375750185163032765741094015988427051","166185186060611001024332905456378095706","51541271195523885020165574289134577189","204878693761635208904314603957421735180","266338435969647641059946272874861407128","55098011225541726281388032498388233315","1343066662292520997264059024562438107","158193622901995251282762541040006388757"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/59675001a55932c51c97d61e303ed2233d5fcb33","signature_type":"Line","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-24cc9bff","target":{"file":"service/java/com/android/role/RoleService.java"}},{"digest":{"length":918,"function_hash":"179922840428870233836870556501484424694"},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/59675001a55932c51c97d61e303ed2233d5fcb33","signature_type":"Function","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-b3e0c311","target":{"function":"setDefaultApplicationAsUser","file":"service/java/com/android/role/RoleService.java"}}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379362792.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-05-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/f21634af468653cce28dfd329998f0eaa85608d4"],"vanir_signatures":[{"digest":{"length":864,"function_hash":"151844552131008059303012353384865945247"},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/f21634af468653cce28dfd329998f0eaa85608d4","signature_type":"Function","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-34aa57b5","target":{"function":"setDefaultApplicationAsUser","file":"service/java/com/android/role/RoleService.java"}},{"digest":{"length":695,"function_hash":"314794437242829043153628501643302551789"},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/f21634af468653cce28dfd329998f0eaa85608d4","signature_type":"Function","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-393fb076","target":{"function":"getDefaultApplicationAsUser","file":"service/java/com/android/role/RoleService.java"}},{"digest":{"line_hashes":["234375750185163032765741094015988427051","196448044159210839824566928509407846644","50957021007188066157753479216643061959","309058815749144677036303055966210877327","266338435969647641059946272874861407128","311310505671132300985013741298119732668","143366912335716162828861201321665272510","122344651461314230269301334336996499756"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/f21634af468653cce28dfd329998f0eaa85608d4","signature_type":"Line","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-cbccd347","target":{"file":"service/java/com/android/role/RoleService.java"}}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379362792.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-05-01","severity":"High","fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/2145a560fc739a4413c4d578e68675195284151a"],"vanir_signatures":[{"digest":{"line_hashes":["307617753914950398489064315436213252518","14351852062216166743514096358391670416","120134473398982474113827221147711853190","213452500809707026770380459210773612058","234375750185163032765741094015988427051","196448044159210839824566928509407846644","50957021007188066157753479216643061959","309058815749144677036303055966210877327","266338435969647641059946272874861407128","311310505671132300985013741298119732668","143366912335716162828861201321665272510","122344651461314230269301334336996499756"],"threshold":0.9},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/2145a560fc739a4413c4d578e68675195284151a","signature_type":"Line","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-56d770d9","target":{"file":"service/java/com/android/role/RoleService.java"}},{"digest":{"length":695,"function_hash":"314794437242829043153628501643302551789"},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/2145a560fc739a4413c4d578e68675195284151a","signature_type":"Function","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-722ef512","target":{"function":"getDefaultApplicationAsUser","file":"service/java/com/android/role/RoleService.java"}},{"digest":{"length":864,"function_hash":"151844552131008059303012353384865945247"},"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/2145a560fc739a4413c4d578e68675195284151a","signature_type":"Function","signature_version":"v1","deprecated":false,"id":"ASB-A-379362792-e5c5c325","target":{"function":"setDefaultApplicationAsUser","file":"service/java/com/android/role/RoleService.java"}}],"types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-379362792.json"}}],"schema_version":"1.7.5"}