Google Android 13/14/15 Image Parser ChooserActivity.java onCreate confused deputy

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Google Android 13/14/15. This affects the function onCreate of the file ChooserActivity.java of the component Image Parser. The manipulation leads to Local Privilege Escalation. This vulnerability is listed as CVE-2025-22416. The attack must be carried out locally. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Google Android 13/14/15. It has been rated as problematic. This issue affects the function onCreate of the file ChooserActivity.java of the component Image Parser. The manipulation with an unknown input leads to a local privilege escalation vulnerability. Using CWE to declare the problem leads to CWE-441. The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

The advisory is shared at android.googlesource.com. The identification of this vulnerability is CVE-2025-22416 since 01/06/2025. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/04/2025).

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-26580). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 13
• 14
• 15

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion