CVE-2025-26435
📋 TL;DR
This vulnerability allows a secondary user on an Android device to disable the primary user's deceptive app scanning setting due to a logic error in the Settings app. This could enable local privilege escalation without requiring additional permissions or user interaction. Affected systems are Android devices with multiple user accounts.
💻 Affected Systems
- Android Settings application
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
A malicious secondary user could disable security protections for the primary user, potentially allowing installation of deceptive apps that compromise the primary user's data and device security.
Likely Case
Secondary users could disable security scanning for primary users, increasing risk of malware installation through deceptive apps.
If Mitigated
With proper user account separation and monitoring, impact is limited to potential security setting changes rather than direct data compromise.
🎯 Exploit Status
Exploitation requires access to a secondary user account but no special permissions. The vulnerability is in the Settings UI logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android Security Update May 2025
Vendor Advisory: https://source.android.com/security/bulletin/2025-05-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install the May 2025 security update. 3. Restart the device after installation.
🔧 Temporary Workarounds
Disable secondary user accounts
androidRemove or disable secondary user accounts to eliminate the attack vector
Settings > System > Multiple users > Remove secondary users
🧯 If You Can't Patch
- Disable multiple user accounts feature on affected devices
- Monitor Settings app changes and restrict secondary user permissions
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If before May 2025 security update and multiple users enabled, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android Security Patch Level shows 'May 5, 2025' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Settings app modifications to deceptive app scanning by secondary users
- Unexpected changes to security settings
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
android.security.settings.changed user_type="secondary" setting="deceptive_app_scanning"