CVE-2025-32347

HIGH

BiometricEnrollIntroduction - Info Disclosure

Title source: llm

Description

In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

References (2)

[Patch, Product] https://android.googlesource.com/platform/packages/apps/Settings/+/25cfacbe5ac2423b8fe1375e0593ef69e98b8d09

[Vendor Advisory] https://source.android.com/security/bulletin/2025-09-01

Scores

CVSS v3 7.8

EPSS 0.0001

EPSS Percentile 0.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-926

Status published

Affected Products (4)

google/android

Timeline

Published Sep 04, 2025

Tracked Since Feb 18, 2026