{"id":"ASB-A-388828203","details":"In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-388828203","CVE-2025-26458"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/9d2acb2d3c5dae5ace5add3e1d0c0e3ab5cfb900"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-06-01"}]}],"versions":["16-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/225602a7d0fecefb42c2456067d91f895c72f190"],"severity":"High","spl":"2025-06-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/225602a7d0fecefb42c2456067d91f895c72f190","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java","function":"deliverOnProviderEnabledChanged"},"deprecated":false,"digest":{"length":300,"function_hash":"97604033295306176689519601934035337094"},"id":"ASB-A-388828203-103ca9da","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/225602a7d0fecefb42c2456067d91f895c72f190","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226333950258713943898902739111038947999","14931390740353749764197852673638337343","93375681817805300150664746634283902909","94018983333741030537591893244016041222","179647063392287317254105949618729427976","187204358426564850211416620950748524882","19320936136198328174170718737097938740","84120755700257044779529719329761715517"]},"id":"ASB-A-388828203-e6381b8b","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/225602a7d0fecefb42c2456067d91f895c72f190","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java","function":"deliverOnLocationChanged"},"deprecated":false,"digest":{"function_hash":"89442080645103971912730621748585174984","length":772},"id":"ASB-A-388828203-e98e6618","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388828203.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-06-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"89442080645103971912730621748585174984","length":772},"id":"ASB-A-388828203-867fb1ec","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53cf3399f5691aab020d44efff5dd01eaf16257b","target":{"function":"deliverOnLocationChanged","file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/53cf3399f5691aab020d44efff5dd01eaf16257b","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java","function":"deliverOnProviderEnabledChanged"},"deprecated":false,"digest":{"function_hash":"97604033295306176689519601934035337094","length":300},"id":"ASB-A-388828203-8cf89c98","signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java"},"deprecated":false,"digest":{"line_hashes":["226333950258713943898902739111038947999","14931390740353749764197852673638337343","93375681817805300150664746634283902909","94018983333741030537591893244016041222","179647063392287317254105949618729427976","187204358426564850211416620950748524882","19320936136198328174170718737097938740","84120755700257044779529719329761715517"],"threshold":0.9},"id":"ASB-A-388828203-c4c9a0cb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/53cf3399f5691aab020d44efff5dd01eaf16257b"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/53cf3399f5691aab020d44efff5dd01eaf16257b"],"severity":"High","spl":"2025-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388828203.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-06-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-388828203-56e63bd7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c5345cbf9c80e05d0511167353a162b2920fd07f","target":{"function":"deliverOnProviderEnabledChanged","file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java"},"deprecated":false,"digest":{"length":300,"function_hash":"97604033295306176689519601934035337094"}},{"id":"ASB-A-388828203-b068970b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c5345cbf9c80e05d0511167353a162b2920fd07f","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226333950258713943898902739111038947999","14931390740353749764197852673638337343","93375681817805300150664746634283902909","94018983333741030537591893244016041222","179647063392287317254105949618729427976","187204358426564850211416620950748524882","19320936136198328174170718737097938740","84120755700257044779529719329761715517"]}},{"digest":{"length":772,"function_hash":"89442080645103971912730621748585174984"},"id":"ASB-A-388828203-f30d9762","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c5345cbf9c80e05d0511167353a162b2920fd07f","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java","function":"deliverOnLocationChanged"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c5345cbf9c80e05d0511167353a162b2920fd07f"],"severity":"High","spl":"2025-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388828203.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-06-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-388828203-2ec260f0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/df4cbfbaecafd0bc0e3bf41708501e197ae57628","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java","function":"deliverOnLocationChanged"},"deprecated":false,"digest":{"length":772,"function_hash":"89442080645103971912730621748585174984"}},{"id":"ASB-A-388828203-9ba2fa3a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/df4cbfbaecafd0bc0e3bf41708501e197ae57628","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java"},"deprecated":false,"digest":{"line_hashes":["226333950258713943898902739111038947999","14931390740353749764197852673638337343","93375681817805300150664746634283902909","94018983333741030537591893244016041222","179647063392287317254105949618729427976","187204358426564850211416620950748524882","19320936136198328174170718737097938740","84120755700257044779529719329761715517"],"threshold":0.9}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/df4cbfbaecafd0bc0e3bf41708501e197ae57628","target":{"file":"services/core/java/com/android/server/location/provider/LocationProviderManager.java","function":"deliverOnProviderEnabledChanged"},"deprecated":false,"digest":{"function_hash":"97604033295306176689519601934035337094","length":300},"id":"ASB-A-388828203-f2a91e71","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/df4cbfbaecafd0bc0e3bf41708501e197ae57628"],"severity":"High","spl":"2025-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388828203.json"}}],"schema_version":"1.9.0"}