CVE-2026-0025
Published: 02 March 2026
Summary
CVE-2026-0025 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-4 (Information in Shared System Resources).
Deeper analysis
CVE-2026-0025 is a permissions bypass vulnerability located in the hasImage method of Notification.java within Android. This flaw enables the revelation of information across users, which can lead to local escalation of privilege. No additional execution privileges are required for exploitation, and user interaction is not needed. The vulnerability is rated at CVSS 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
A local attacker can exploit this vulnerability with no privileges (PR:N), low attack complexity (AC:L), and without requiring user interaction (UI:N). Exploitation allows high-impact compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), facilitating escalation of privilege across user boundaries on affected Android devices.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01, published on 2026-03-01, provides details on patches and mitigation for this CVE. Security practitioners should consult the bulletin for version-specific remediation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9239
Vulnerability details
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local permissions bypass enabling privilege escalation without credentials or interaction directly matches exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations to directly prevent the permissions bypass in hasImage that reveals cross-user notification information.
Prevents unauthorized information transfer across users via shared system resources exploited by the notification vulnerability.
Limits the impact of local privilege escalation resulting from the cross-user information disclosure by restricting privileges to the minimum necessary.