CVE-2025-26444

HighCVSS 7.8/10Last modified Sep 30, 2026

Description

In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in the code. This could lead to local escalation of privilege where the default assistant app is automatically granted ROLE_ASSISTANT with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Google	Android	14; 13

References

https://android.googlesource.com/platform/frameworks/base/+/c439c7e75e73056e6201fa4f4fe340e715196182Patch, Product
https://source.android.com/security/bulletin/2025-05-01Vendor Advisory

Timeline

Published: Sep 4, 2025
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-264455.5In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead t CVE-2025-264485.5In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information CVE-2025-264495.5In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of servic CVE-2025-26456.1A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. Affected is an unknown fun CVE-2025-264507.8In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the defa CVE-2025-264527.8In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. Thi CVE-2025-264535.5In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic error in the code. Thi CVE-2025-264547.8In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused CVE-2025-264557.8In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local CVE-2025-264565.5In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error in the code. This coul CVE-2025-264587.8In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This CVE-2025-26469.8A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability