ASB-A-371975420 — Vulnetix

ASB-A-371975420 PUBLISHED

In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Products

Vendor	Product	Versions
platform	frameworks/base	15-next, 15:0, 15

Timeline

Jan 1, 2025 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2025-01-01 advisory
https://android.googlesource.com/platform/frameworks/base/+/076a97aa32492cc44e863f7ab75494dc0b3bf5ef patch

Open in Interactive Console →