February 2025: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 23 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r17 adds the fix for 5 CVEs: CVE-2024-49729, CVE-2025-0091, CVE-2025-0094, CVE-2025-0095, CVE-2025-0100.

android-security-15.0.0_r5 adds the fix for 14 CVEs: CVE-2023-40122, CVE-2024-0037, CVE-2024-49723, CVE-2024-49729, CVE-2024-49743, CVE-2024-49746, CVE-2025-0091, CVE-2025-0094, CVE-2025-0095, CVE-2025-0096, CVE-2025-0097, CVE-2025-0098, CVE-2025-0099, CVE-2025-0100.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

android-security-15.0.0_r5 carries a platform update (1412 code commits): most of its commits are not security fixes.

Android 15: 632 fixes in android-security-15.0.0_r5

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2023-40122 · platform/frameworks/base
  Adds user-ownership checks on content URIs in UI content supplied by an autofill service. On Android 14, SaveUi now runs Helper.sanitizeRemoteView on the CustomDescription BatchUpdates RemoteViews. Inline suggestion rendering is skipped when the InlinePresentation Slice contains URI-backed icons owned by a different user (new Helper.sanitizeSlice). sanitizeRemoteView now resolves URIs against the checked userId with the two-argument getUserIdFromUri.
• CVE-2024-0037 · platform/frameworks/base
  Adds cross-user URI ownership checks to Autofill UI content supplied by the autofill service. A new Helper.sanitizeSlice() gates inline suggestion rendering in RemoteInlineSuggestionViewConnector.renderSuggestion. SaveUi now passes CustomDescription BatchUpdates RemoteViews through Helper.sanitizeRemoteView. sanitizeRemoteView now resolves URIs that carry no explicit user against the checked userId.
• CVE-2024-49723 · platform/external/conscrypt (NativeCrypto TLS cipher suite enumeration) and platform/libcore (test support StandardNames)
  Conscrypt no longer explicitly adds 3DES cipher suites to its supported TLS 1.2 cipher suite list: the BoringSSL cipher query in NativeCrypto changes from "ALL:3DES" to "ALL", and the Conscrypt and libcore StandardNames test expectations drop the 3DES suite names.
• CVE-2024-49729 · platform/system/core
  libdm's DeviceMapper::GetTable now replaces the key field of dm-crypt target parameter strings with the literal "redacted" when the table is queried with DM_STATUS_TABLE_FLAG (i.e. via GetTableInfo), so callers no longer receive the raw encryption key.
• CVE-2024-49741 · platform/frameworks/base
  Adds hard caps in AppWidgetServiceImpl of 20 hosts per (uid, package) and 200 widgets per host, evicting the oldest host or widget before a new one is added so an app cannot grow the service's host/widget state without bound.
• CVE-2024-49743 · platform/frameworks/base
  Hardens Notification allowlist-token handling: NMS rejects enqueued notifications carrying a token other than its own ALLOWLIST_TOKEN and forces the correct token on records it enqueues, while Notification parceling writes only the root notification's token for all nested notifications and unparceling keeps an existing PendingIntent cookie instead of letting inner notifications replace it.
• CVE-2024-49746 · platform/frameworks/native
  Parcel::continueWrite in libbinder no longer closes every file descriptor of a parcel with an mOwner buffer when the parcel is resized. It closes only FDs in the truncated region, drops objects that straddle the new size, and marks retained kernel FDs as owned. The fix also adds bounds checks to the RPC object truncation paths.
• CVE-2025-0091 · platform/packages/apps/Settings
  Settings' AccountTypePreferenceLoader.isSafeIntent now returns false for any authenticator-supplied preference Intent whose scheme is "content", so it is not treated as safe to launch.
• CVE-2025-0094 · platform/packages/apps/Settings
  Adds a `!mUserManager.isProfile()` condition to UserSettings.onCreateOptionsMenu so that a profile (e.g. a work profile) that manages to open the UserSettings screen is no longer offered the "Remove this user" overflow menu item.
• CVE-2025-0095 · platform/packages/apps/Settings
  Pins the Settings.ACTION_APP_USAGE_SETTINGS intent launched from the App info "time spent" preference to the package named by config_systemWellbeing and resolves it with MATCH_SYSTEM_ONLY, instead of launching an implicit intent after only checking that some system app could handle it.
• CVE-2025-0096 · platform/hardware/st/nfc
  Enlarges the heap buffer allocated for the FieldOn/FieldOff TLV in handlePollingLoopData from 8 to 9 bytes so that the nine bytes written into it no longer overflow the allocation.
• CVE-2025-0097 · platform/frameworks/base
  WindowManagerService.transferTouchGesture now records Binder.getCallingUid() before clearing the calling identity. EmbeddedWindowController.transferToHost and transferToEmbedded then throw a SecurityException unless that UID owns the transferFrom side (the embedded window owner or the host WindowState owner), so a process can no longer move an active touch gesture from a window it does not own.
• CVE-2025-0098 · platform/frameworks/base
  Hardens TaskFragmentOrganizerController so that a real activity token is handed to a task fragment organizer only when both the pid and the uid of the activity match the organizer, and rejects organizer registration from a pid <= 0 (the commit message says a one-way binder call let a malicious app appear as pid 0).
• CVE-2025-0099 · platform/frameworks/base
  Adds a SYSTEM_UID calling-UID check to the CompanionDeviceManagerService binder methods getBackupPayload and applyRestoredPayload, so callers that are not the system UID are rejected with a SecurityException.
• CVE-2025-0100 · platform/frameworks/base
  MediaProjectionPermissionActivity.onCreate now takes the requesting package from getLaunchedFromPackage() instead of getCallingPackage(), and still uses getCallingPackage() == null to pick out the system_server launch path.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).