CVE-2025-26443

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Sep 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-264447.8In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default CVE-2025-264455.5In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead t CVE-2025-264485.5In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information CVE-2025-264495.5In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of servic CVE-2025-26456.1A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. Affected is an unknown fun CVE-2025-264507.8In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defa CVE-2025-264527.8In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. Thi CVE-2025-264535.5In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. Thi CVE-2025-264547.8In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused CVE-2025-264557.8In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local CVE-2025-264565.5In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error in the code. This coul CVE-2025-264587.8In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This