CVE-2025-0087
📋 TL;DR
This vulnerability allows a malicious app to uninstall apps belonging to other users on the same Android device without proper permission checks. It affects Android devices with multiple user profiles where the attacker has local access. Exploitation requires no user interaction and can lead to privilege escalation.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker could uninstall critical system apps or security software, potentially disabling device protection mechanisms and enabling further attacks.
Likely Case
Malicious app removes competing apps or security tools from other user profiles, causing data loss and service disruption.
If Mitigated
With proper app sandboxing and user profile isolation, impact is limited to non-critical apps in the same user profile.
🎯 Exploit Status
Requires a malicious app to be installed on the device. No authentication bypass needed once app is installed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android May 2025 security update
Vendor Advisory: https://source.android.com/security/bulletin/2025-05-01
Restart Required: No
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install the May 2025 security update. 3. No device restart required after update installation.
🔧 Temporary Workarounds
Disable multiple user profiles
AndroidRemove additional user profiles to eliminate the attack surface
Settings > System > Multiple users > Remove all additional users
Restrict app installations
AndroidOnly allow app installations from trusted sources like Google Play Store
Settings > Security > Install unknown apps > Disable for all apps
🧯 If You Can't Patch
- Monitor for unexpected app uninstallations across user profiles
- Implement mobile device management (MDM) to control app installations and user profile creation
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If before May 2025 security update and multiple users exist, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level is May 2025 or later in Settings > About phone > Android security update.📡 Detection & Monitoring
Log Indicators:
- PackageManager logs showing app uninstallations from different user IDs
- Security logs showing permission denial attempts for UNINSTALL_PACKAGES
Network Indicators:
- None - this is a local attack
SIEM Query:
source="android_system" AND "PackageManager" AND "UNINSTALL" AND user_id!="current_user"