Skip to content
OpenAdvisories
Medium · 6.2 CVE-2025-0086 EUVD-2025-25853GHSA-4w4f-hjcg-mrfp

In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could le…

Published Aug 26, 2025 · Updated Aug 27, 2025 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

VendorProductAffectedFixed
Google Android 15, 14, 13, 12L, 12 —

Advisories 1

References