What’s Vulnerable › Vulnerabilities

CVE-2025-26428

• Severity: low (CVSS 3.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-04 · updated 2026-06-17
• Weakness: CWE-290

Description

In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected products

• Android: 13.0, 14.0, 15.0

References

• https://android.googlesource.com/platform/frameworks/base/+/afd05dc17e027734f665ac978ad6fb4584b6fd40
• https://source.android.com/security/bulletin/2025-05-01

Get alerted when CVE-2025-26428 or the next vulnerability affects your stack