Local Privilege Escalation Vulnerability in Android Settings

CVE-2025-32345

What is CVE-2025-32345?

A logic error in the updateState method of ContentProtectionTogglePreferenceController.java allows secondary users to disable the primary user's deceptive app scanning setting on Android devices. This vulnerability does not require any additional execution privileges or user interaction for exploitation, presenting significant security risks for users relying on app protection features. The flaw highlights a critical consideration for Android's security model and the importance of user permissions.

References