CVE-2025-26420

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission overload. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-264214.0In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of priviCVE-2025-264224.0In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permissionCVE-2025-264236.2In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. CVE-2025-264244.0In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to locaCVE-2025-264254.0In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This couCVE-2025-264265.1In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" packCVE-2025-264274.4In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privileCVE-2025-264283.2In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead toCVE-2025-264295.5In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to locCVE-2025-26439.8A vulnerability has been found in PHPGurukul Art Gallery Management System 1.0 and classified as critical. This vulnerability affects unknowCVE-2025-264307.8In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could leaCVE-2025-264317.8In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic
CVE-2025-26420: Medium severity, CVSS 4.4 | Vulnix