May 2025: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 22 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r20 adds the fix for 15 CVEs: CVE-2023-35657, CVE-2025-22425, CVE-2025-26420, CVE-2025-26421, CVE-2025-26423, CVE-2025-26425, CVE-2025-26426, CVE-2025-26428, CVE-2025-26429, CVE-2025-26436, CVE-2025-26438, CVE-2025-26440, CVE-2025-26442, CVE-2025-26444, CVE-2025-27363.

android-security-15.0.0_r8 adds the fix for 15 CVEs: CVE-2023-35657, CVE-2025-0077, CVE-2025-26421, CVE-2025-26422, CVE-2025-26423, CVE-2025-26424, CVE-2025-26425, CVE-2025-26426, CVE-2025-26428, CVE-2025-26429, CVE-2025-26430, CVE-2025-26435, CVE-2025-26436, CVE-2025-26438, CVE-2025-26442.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 15: 3 fixes in android-security-15.0.0_r8

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2023-35657 · platform/packages/modules/Bluetooth
  In bta_av_setconfig_rej (system/bta/av/bta_av_aact.cc), the peer address placed in the BTA AV reject callback data is now taken from the stream control block (p_scb->PeerAddress()) instead of reading p_data->str_msg.bd_addr from a union that the caller may not have populated as a tBTA_AV_STR_MSG.
• CVE-2024-34739 · platform/frameworks/base
  Adds a USER_SETUP_COMPLETE check in UsbProfileGroupSettingsManager so that the USB device-attached path returns before resolveActivity while the current user's setup is still in progress.
• CVE-2025-0077 · platform/frameworks/base
  Restores locking the device (keyguard shown and waited for) at the beginning of a foreground user switch in UserController.startUser, moves the IUserSwitchObserver.onBeforeUserSwitching dispatch to that same early point, and makes onBeforeUserSwitching a synchronous binder call so observers (SystemUI user tracking) have updated the current user before the keyguard is locked.
• CVE-2025-0087 · platform/frameworks/base
  UninstallerActivity now only accepts a cross-user uninstall request when the requesting user is the profile parent of the target user, replacing a check that accepted any user returned by userManager.getUserProfiles().
• CVE-2025-22425 · platform/frameworks/base
  PackageInstaller's InstallStart activity stops identifying the originating package via Activity.getCallingPackage() and uses getLaunchedFromPackage() instead. A follow-up commit removes the now-dead null-check branch that replaced the calling package with the PackageInstaller session's installer package name.
• CVE-2025-26420 · platform/packages/modules/Permission
  GrantPermissionsActivity now merges an older, still-showing permission dialog from the same package and task into a newly launched one, and caps simultaneous dialogs per package/task at 10, instead of letting multiple independent dialogs coexist.
• CVE-2025-26421 · platform/packages/apps/Settings (app info: AppButtonsPreferenceController
  Adds an OEM-configurable list of "biometric protected" packages (frameworks/base resource config_biometric_protected_package_names). The Settings app-info screens (legacy AppButtonsPreferenceController and SPA PackageInfoPresenter) now require lock-screen confirmation via AppInfoDashboardFragment.showLockScreen before disabling, force-stopping or uninstalling (updates of) a package on that list.
• CVE-2025-26422 · platform/frameworks/base
  Moves the DumpUtils.checkDumpPermission check in WindowManagerService from the private doDump helper into the Binder-exposed dump() entry point, before PriorityDump.dump is called, so that the --high-priority dump (named in the commit title) is permission-gated.
• CVE-2025-26423 · platform/packages/modules/Wifi
  Adds size and validity checks for the static IP configuration (DNS server count, domains length) and HTTP proxy info (isValid, host length, exclusion list count and total length) in WifiConfigurationUtil.validateIpConfiguration, so that oversized IP configuration data supplied with a WifiConfiguration is rejected during validation.
• CVE-2025-26424 · platform/frameworks/base
  Adds NETWORK_STACK / MAINLINE_NETWORK_STACK permission enforcement to the four VPN profile store binder methods (get/put/remove/list) in VpnManagerService, which previously had no caller permission check.
• CVE-2025-26425 · platform/packages/modules/Permission
  Adds an SDK-level precondition (SdkLevel.isAtLeastU()) at the top of RoleService's binder methods getDefaultApplicationAsUser and setDefaultApplicationAsUser so they throw IllegalStateException instead of executing when the Permission module runs on a platform below Android 14 (API 34).
• CVE-2025-26426 · platform/frameworks/base
  Removes the special case in ActivityManagerService.registerReceiverWithFeature that let any caller pass "android" as callerPackage without being validated against the calling process's package list, and then widens the exemption from SYSTEM_UID to all core uids so system components in other core processes keep working.
• CVE-2025-26427 · platform/packages/apps/DocumentsUI (picker ActionHandler)
  Extends the Android 11 SAF privacy restriction on /Android/data, /Android/obb and /Android/sandbox to their whole subtrees. ExternalStorageProvider now hides those subtrees through a new FileSystemProvider.shouldHideDocument() hook, and the DocumentsUI picker no longer launches to an EXTRA_INITIAL_URI inside them.
• CVE-2025-26428 · platform/frameworks/base
  Adds an early return in LockTaskController.startLockTaskMode so that an app-initiated request on a LOCK_TASK_AUTH_PINNABLE task that is already in mLockTaskModeTasks no longer triggers a new screen pinning request via StatusBarManagerInternal.showScreenPinningRequest.
• CVE-2025-26429 · platform/frameworks/base
  Adds a cap of about 2000 (NUM_ATTRIBUTED_OP_ENTRY_THRESHOLD) on the total number of attributed op entries that AppOpsService packs into the OpEntry list returned for IAppOpsService#getPackagesForOpsForDevice, so the reply is less likely to exceed the binder transaction limit.
• CVE-2025-26430 · platform/packages/apps/Settings
  SpaAppBridgeActivity.getDestinationForApp now validates that the package name taken from the incoming "package:" intent URI matches a package-name regex before interpolating it into the SPA navigation route, returning null otherwise.
• CVE-2025-26435 · platform/packages/apps/Settings
  The Settings content protection toggle controller now disables its main switch bar when the current user is a guest user, so a guest can no longer flip the content protection switch from that screen.
• CVE-2025-26436 · platform/frameworks/base
  PendingIntentRecord.clearAllowBgActivityStarts now also downgrades the token's duration-based temp-allowlist entry from TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_ALLOWED to TEMPORARY_ALLOWLIST_TYPE_FOREGROUND_SERVICE_NOT_ALLOWED, instead of only removing the token from the BAL token sets; a companion commit adds equals/hashCode to BackgroundStartPrivileges for the tests.
• CVE-2025-26438 · platform/packages/modules/Bluetooth
  Adds a check in smp_process_secure_connection_oob_data that aborts LE Secure Connections OOB pairing with SMP_OOB_FAIL when the peer's OOB flag is SMP_OOB_PRESENT but no local OOB data is stored, instead of continuing with a zeroed local randomizer.
• CVE-2025-26440 · platform/frameworks/av (libcameraservice
  CameraService now registers its AppOps watcher with WATCH_FOREGROUND_CHANGES and blocks untrusted MODE_IGNORED clients that are not user-visible (proc state above PROCESS_STATE_BOUND_TOP). Before, it decided between mute and block based on whether the uid was "active". AppOpsUidStateTrackerImpl now delays committing a uid-state change that loses a capability instead of committing it immediately.
• CVE-2025-26442 · platform/packages/apps/Settings
  The Settings NotificationAccessConfirmationActivity now matches the requested notification listener against the full ComponentName of each resolved NotificationListenerService instead of only its package name, so the BIND_NOTIFICATION_LISTENER_SERVICE permission and intent-filter checks are applied to the exact requested service.
• CVE-2025-26444 · platform/frameworks/base
  Removes the code in VoiceInteractionManagerService's PackageMonitor.onHandleForceStop that ran when the current voice interactor package was force stopped. That code nulled the interactor and recognizer settings, reset the current assistant, re-ran initForUser and cleared the ROLE_ASSISTANT role holders (falling back to the roles.xml default). Now the service is only shut down and restarted.
• CVE-2025-27363 · platform/external/freetype
  Restructures heap buffer allocation in external/freetype src/truetype/ttgload.c in two places. In the TrueType composite-glyph variation path (load_truetype_glyph), the temporary outline is now allocated directly into the FT_Outline fields with explicit sizes, and n_points/n_contours are set only after allocation succeeds. In TT_Process_Simple_Glyph, the unrounded array switches to a non-zeroing allocation.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).