June 2025: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 18 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r21 adds the fix for 13 CVEs: CVE-2025-26443, CVE-2025-26445, CVE-2025-26448, CVE-2025-26449, CVE-2025-26450, CVE-2025-26452, CVE-2025-26453, CVE-2025-26455, CVE-2025-26456, CVE-2025-26458, CVE-2025-26462, CVE-2025-26463, CVE-2025-32312.

android-security-15.0.0_r9 adds the fix for 15 CVEs: CVE-2025-26432, CVE-2025-26437, CVE-2025-26443, CVE-2025-26445, CVE-2025-26448, CVE-2025-26449, CVE-2025-26450, CVE-2025-26452, CVE-2025-26453, CVE-2025-26455, CVE-2025-26456, CVE-2025-26458, CVE-2025-26462, CVE-2025-26463, CVE-2025-32312.

Announced, with no public code

None this month.

Announced, but the patched code is not there

No fix in the tags, and none of the code the bulletin's commit patches exists in these majors: it was removed or reworked before their release (probable).

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 1 fix in android-security-14.0.0_r21

Android 15: 2 fixes in android-security-15.0.0_r9

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2025-26432 · platform/frameworks/base
  Adds a 1024-character upper bound on the tag string accepted by CompanionDeviceManagerService's setAssociationTag binder method, rejecting longer tags with IllegalArgumentException before they reach AssociationRequestsProcessor.
• CVE-2025-26437 · platform/frameworks/base
  Adds a caller identity check to the CredentialManagerService binder entry point that creates a GetCandidateRequestSession. Only the package configured as the device's credential autofill service (R.string.config_defaultCredentialManagerAutofillService) can invoke it; all other callers get a SecurityException.
• CVE-2025-26441 · platform/packages/modules/Bluetooth
  Adds a one-byte bounds check at the top of add_attr in system/stack/sdp/sdp_discovery.cc so the attribute type byte is not read when no bytes remain before p_end.
• CVE-2025-26443 · platform/packages/apps/ManagedProvisioning
  HtmlToSpannedParser in ManagedProvisioning now rejects any URLSpan whose URL is not http:// or https:// (returning null for the whole parsed text) before handing the URL to UrlIntentFactory, so links embedded in the TermsActivity HTML can no longer produce intents for other schemes.
• CVE-2025-26445 · platform/packages/modules/Connectivity
  Adds a missing caller permission check to ConnectivityService.offerNetwork so that only holders of NETWORK_FACTORY/MAINLINE_NETWORK_STACK (or MANAGE_TEST_NETWORKS for TRANSPORT_TEST offers) can register a network offer.
• CVE-2025-26448 · platform/frameworks/base
  Replaces malloc with calloc for the inline CursorWindow data buffer in CursorWindow::create() so the buffer is zero-initialized before it can be parcelled to a remote process.
• CVE-2025-26449 · platform/frameworks/base
  Changes Zen-mode rule parceling in frameworks/base so that the automatic rules inside ZenModeConfig and the INotificationManager.getZenRules() return value are carried in a ParceledListSlice instead of an inline typed array/List, and switches the string members of ZenModeConfig.ZenRule and AutomaticZenRule (and the rule id array) to String8 encoding.
• CVE-2025-26450 · platform/frameworks/base
  The IME-side input event receiver (IInputMethodSessionWrapper.ImeInputEventReceiver.onInputEvent) now checks any KeyEvent with Ctrl/Alt/Fn/Meta modifiers using InputManager.verifyInputEvent plus a 100 ms age check before dispatching it to the InputMethodSession, and drops events that fail.
• CVE-2025-26452 · platform/frameworks/base
  Restricts the "frro:" drawable-loading branch in ResourcesImpl. The file named in the resource value is now opened only if its canonical path is under /data/resource-cache/, ends in ".frro" and is readable, and only if the offset parameter is non-negative and the size parameter is positive.
• CVE-2025-26453 · platform/packages/modules/Bluetooth
  Changes BluetoothOppSendFileInfo.isContentUriForOtherUser to derive the user id from the decoded Uri authority (text before the last '@') instead of Uri.getUserInfo(), so Bluetooth OPP's cross-user content URI check agrees with how ContentProvider resolves the target user.
• CVE-2025-26455 · platform/frameworks/av
  Makes the pointer/size pairs returned by the NDK AMediaCodec_getInputBuffer and AMediaCodec_getOutputBuffer APIs consistent (input: base pointer with capacity; output: data pointer with actual size) and sets the offset reported by AMediaCodec_dequeueOutputBuffer to 0 because the output pointer is already offset.
• CVE-2025-26456 · platform/art
  Bounds the ART dex-use database in DexUseManagerLocal by capping secondary dex path length (4096), class loader context length (10000) and the number of secondary dex entries per owning package (500). Two follow-up commits first made the companion file-existence check symlink-safe and then removed it entirely because of sepolicy restrictions.
• CVE-2025-26458 · platform/frameworks/base
  Adds options.setPendingIntentBackgroundActivityLaunchAllowed(false) to the BroadcastOptions that LocationPendingIntentTransport in LocationProviderManager.java uses when system_server sends a client-supplied PendingIntent, so these sends explicitly deny background activity launch.
• CVE-2025-26462 · platform/frameworks/base
  Adds an onNullBinding override to AccessibilityServiceConnection that calls unbindLocked() under mLock, so system_server no longer stays bound to an accessibility service whose onBind() returned null and that service can no longer launch activities from the background (BAL).
• CVE-2025-26463 · platform/frameworks/base
  Adds hard upper bounds (223 chars for packageName, 32 bytes for certificate) to BlobStoreManager.Session.allowPackageAccess on the client side and to BlobStoreSession.allowPackageAccess in system_server, rejecting oversized inputs with IllegalArgumentException.
• CVE-2025-32312 · platform/frameworks/base
  Adds a type check in PackageParser's createIntentsList so that a class read by name from a Parcel is only constructed if it is a subclass of IntentInfo. Before, the code reflectively constructed any class named in the parcel.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).