CVE-2025-32347
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In the onStart method of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent, which could lead to local escalation of privilege. User interaction is needed.
Risk Assessment
Disclosure of device location can violate user privacy, and privilege escalation could allow an attacker to access sensitive system functions.
Recommendation
Update the system to a version that includes the fix, which removes the unsafe PendingIntent.
Other vulnerabilities in Android framework
See all- CVE-2017-0667High
CVE-2017-0667 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0666High
CVE-2017-0666 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0665High
CVE-2017-0665 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0664High
CVE-2017-0664 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2016-3832High
The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, allowing attackers to bypass an unspecified protection mechanism via a crafted application.
- CVE-2025-22438High
In the afterKeyEventLockedInterruptable method of InputDispatcher.cpp, there is a possible use after free, which could lead to local escalation of privilege. User interaction is not needed.
Original NVD description (English source)
In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS