{"id":"ASB-A-406763872","details":"In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-406763872","CVE-2025-32324"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/55361a549fc2a46a91c6cf23f9ea498eb04ef643"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":5931,"function_hash":"213738839934792570755609595056424607326"},"id":"ASB-A-406763872-f13022cd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fca9c788b3364017b021544ec9594b43c93c9d29","target":{"file":"services/core/java/com/android/server/am/ActivityManagerShellCommand.java","function":"onCommand"}},{"deprecated":false,"digest":{"line_hashes":["277472483570310443554649752508437610294","271991788737032558508827576779721730867","270586444918517067921252002381739661394","169062682699780730607004408801798937605","246151562963722622899681724648247786506","105103137422926747685189770179435141323","333076504460159676371228333002560705836","215664126275953478246350045277998730221","263835634168807192073843221255401220485","302995394820661178675232868348972694433","139787834065667595998987686951281735568","200838154636922522525854984276619399646","160487007457949671814478683653197599720","100725039237933242708454026680112322729","12711774417692576766033028299880672384","67841973961292751820946283339214161757","64377571066099488212851770765831211700","316951876827181092656507627433633630558"],"threshold":0.9},"id":"ASB-A-406763872-f72751e5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fca9c788b3364017b021544ec9594b43c93c9d29","target":{"file":"services/core/java/com/android/server/am/ActivityManagerShellCommand.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fca9c788b3364017b021544ec9594b43c93c9d29"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-406763872.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/am/ActivityManagerShellCommand.java","function":"onCommand"},"deprecated":false,"digest":{"length":5610,"function_hash":"307496182829459779372876339580988231691"},"id":"ASB-A-406763872-80e40b48","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b04474764693d7ad05c64925a271c94574c6cb11"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b04474764693d7ad05c64925a271c94574c6cb11","target":{"file":"services/core/java/com/android/server/am/ActivityManagerShellCommand.java"},"deprecated":false,"digest":{"line_hashes":["277472483570310443554649752508437610294","271991788737032558508827576779721730867","270586444918517067921252002381739661394","169062682699780730607004408801798937605","246151562963722622899681724648247786506","105103137422926747685189770179435141323","333076504460159676371228333002560705836","215664126275953478246350045277998730221","263835634168807192073843221255401220485","302995394820661178675232868348972694433","139787834065667595998987686951281735568","200838154636922522525854984276619399646","160487007457949671814478683653197599720","100725039237933242708454026680112322729","12711774417692576766033028299880672384","67841973961292751820946283339214161757","64377571066099488212851770765831211700","316951876827181092656507627433633630558"],"threshold":0.9},"id":"ASB-A-406763872-df909262","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b04474764693d7ad05c64925a271c94574c6cb11"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-406763872.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["277472483570310443554649752508437610294","271991788737032558508827576779721730867","270586444918517067921252002381739661394","169062682699780730607004408801798937605","246151562963722622899681724648247786506","105103137422926747685189770179435141323","333076504460159676371228333002560705836","215664126275953478246350045277998730221","263835634168807192073843221255401220485","302995394820661178675232868348972694433","139787834065667595998987686951281735568","200838154636922522525854984276619399646","160487007457949671814478683653197599720","100725039237933242708454026680112322729","12711774417692576766033028299880672384","67841973961292751820946283339214161757","64377571066099488212851770765831211700","316951876827181092656507627433633630558"],"threshold":0.9},"id":"ASB-A-406763872-1184d545","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c96de2de142edb854d39f5197c2f0fe6618aa482","target":{"file":"services/core/java/com/android/server/am/ActivityManagerShellCommand.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c96de2de142edb854d39f5197c2f0fe6618aa482","target":{"function":"onCommand","file":"services/core/java/com/android/server/am/ActivityManagerShellCommand.java"},"deprecated":false,"digest":{"function_hash":"130877303433342042913473096369566809268","length":5840},"id":"ASB-A-406763872-82e7d0f0"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c96de2de142edb854d39f5197c2f0fe6618aa482"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-406763872.json"}}],"schema_version":"1.9.0"}