Vulnerability · Google Android
CVE-2025-22426
In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS score (v3.1)7.8High
Not on CISA KEV list
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
Affected products
| Product | Versions |
|---|---|
| Google Android | 14.0 only; 15.0 only; 16.0 only; 16.0-qpr2_beta_1 only; 16.0-qpr2_beta_2 only; 16.0-qpr2_beta_3 only |
Sources: NVD and CISA known exploited vulnerabilities catalogue.