CVE-2025-26428

LOW

Android - Lock Screen Bypass via LockTaskController Logic Error

Title source: llm

Description

In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References (2)

Core 2

Core References

Patch

https://android.googlesource.com/platform/frameworks/base/+/afd05dc17e027734f665ac978ad6fb4584b6fd40

Vendor Advisory

https://source.android.com/security/bulletin/2025-05-01

Scores

CVSS v3 3.2

EPSS 0.0010

EPSS Percentile 1.1%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-290

Status published

Products (3)

google/android 13.0

google/android 14.0

google/android 15.0

Published Sep 04, 2025

Tracked Since Feb 18, 2026