CVE-2025-22439

HIGH

Android - Missing Authorization in ActionHandler onLastAccessedStackLoaded

Title source: llm

Description

In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References (2)

Core 2

Core References

Product

https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/1f283d5b87d0c8f04a79d1d2a51ed4d9327ae864

Vendor Advisory

https://source.android.com/security/bulletin/2025-04-01

Scores

CVSS v3 7.3

EPSS 0.0001

EPSS Percentile 0.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-862

Status published

Products (3)

google/android 13.0

google/android 14.0

google/android 15.0

Published Sep 02, 2025

Tracked Since Feb 18, 2026