{"id":"ASB-A-395643490","details":"In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-395643490","CVE-2025-26453"],"modified":"2026-04-21T15:25:42.831358Z","published":"2025-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/495d32429fd801c6cd7fe5e568b9c805f47fb4ed"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-06-01"}]}],"versions":["16-next"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["11559564152567410588841309182019922453","337809177206004408410866049586567079404","243609537335498261158402131136130791968","166773958120470170245871513799902712038","258350316179677958070410293551336327512","339113351835433311248376092654761255280","112717731568769911142188584640700964495","34428064101220884156165098493368061377","172952041559240759459238309440144356394"],"threshold":0.9},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb8a03783901dc92738fdd9af6f3ca88feda4bcf","target":{"file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Line","id":"ASB-A-395643490-8802a875","deprecated":false},{"digest":{"function_hash":"75651737353455493637771210726560281246","length":177},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb8a03783901dc92738fdd9af6f3ca88feda4bcf","target":{"function":"isContentUriForOtherUser","file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Function","id":"ASB-A-395643490-9b546d54","deprecated":false}],"spl":"2025-06-01","types":["ID"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb8a03783901dc92738fdd9af6f3ca88feda4bcf"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395643490.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-06-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["11559564152567410588841309182019922453","337809177206004408410866049586567079404","243609537335498261158402131136130791968","166773958120470170245871513799902712038","258350316179677958070410293551336327512","339113351835433311248376092654761255280","112717731568769911142188584640700964495","34428064101220884156165098493368061377","172952041559240759459238309440144356394"],"threshold":0.9},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/230fa5b83f10c34983cbf7637faef6c060b8ef25","target":{"file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Line","id":"ASB-A-395643490-54f37dff","deprecated":false},{"digest":{"function_hash":"75651737353455493637771210726560281246","length":177},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/230fa5b83f10c34983cbf7637faef6c060b8ef25","target":{"function":"isContentUriForOtherUser","file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Function","id":"ASB-A-395643490-a81667a3","deprecated":false}],"spl":"2025-06-01","types":["ID"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/230fa5b83f10c34983cbf7637faef6c060b8ef25"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395643490.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-06-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["258350316179677958070410293551336327512","339113351835433311248376092654761255280","112717731568769911142188584640700964495","34428064101220884156165098493368061377","172952041559240759459238309440144356394"],"threshold":0.9},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6bb33205dbc8e331a01356cc0ad6c36c27d1f6d9","target":{"file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Line","id":"ASB-A-395643490-2d0725e4","deprecated":false},{"digest":{"function_hash":"75651737353455493637771210726560281246","length":177},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6bb33205dbc8e331a01356cc0ad6c36c27d1f6d9","target":{"function":"isContentUriForOtherUser","file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Function","id":"ASB-A-395643490-c77a9f0a","deprecated":false}],"spl":"2025-06-01","types":["ID"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6bb33205dbc8e331a01356cc0ad6c36c27d1f6d9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395643490.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-06-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"line_hashes":["258350316179677958070410293551336327512","339113351835433311248376092654761255280","112717731568769911142188584640700964495","34428064101220884156165098493368061377","172952041559240759459238309440144356394"],"threshold":0.9},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73ef4306e91bc500769f2abbad94b61742c43602","target":{"file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Line","id":"ASB-A-395643490-5311b3f4","deprecated":false},{"digest":{"function_hash":"75651737353455493637771210726560281246","length":177},"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73ef4306e91bc500769f2abbad94b61742c43602","target":{"function":"isContentUriForOtherUser","file":"android/app/src/com/android/bluetooth/opp/BluetoothOppSendFileInfo.java"},"signature_type":"Function","id":"ASB-A-395643490-be0ab433","deprecated":false}],"spl":"2025-06-01","types":["ID"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/73ef4306e91bc500769f2abbad94b61742c43602"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-395643490.json"}}],"schema_version":"1.7.5"}