Listen to this Post
How the CVE works:
The vulnerability resides in multiple functions within NotificationStation.java in the Android framework. NotificationStation handles notifications across different user profiles, such as work and personal profiles. A confused deputy attack occurs due to improper validation of profile boundaries in these functions. Specifically, the code fails to adequately verify the source profile when processing notification-related intents or broadcasts. This allows a malicious app from one profile to send crafted requests that trick NotificationStation, which operates with system privileges, into disclosing or manipulating notifications from another profile. The attack exploits the system’s trust in NotificationStation to perform unauthorized actions without user interaction. By leveraging this flaw, an attacker can access sensitive notification data, such as private messages or app alerts, from a isolated profile. This information disclosure can then be used to escalate privileges locally, potentially gaining access to restricted functions or data. The exploit requires no additional permissions, bypassing Android’s sandboxing and isolation mechanisms. The root cause is missing or incorrect checks for profile IDs in intent handling or broadcast receivers, compromising the security model designed to separate profiles.
Platform: Android
Version: Multiple Android versions
Vulnerability: Confused deputy attack
Severity: Critical
Date: 12/08/2025
Prediction: December 2025 patch
What Undercode Say:
Analytics:
adb shell dumpsys notification | grep -i profile
adb logcat | grep NotificationStation
// Vulnerable code snippet from NotificationStation.java
public void handleNotification(Intent intent) {
// Missing profile check
String data = intent.getStringExtra(“notification_data”);
// Process without verification
}
How Exploit:
Craft malicious intents.
Exploit broadcast receivers.
Bypass profile isolation.
Protection from this CVE:
Apply security updates.
Restrict notification access.
Enable profile isolation.
Impact:
Local privilege escalation.
Cross-profile data leakage.
Sensitive information compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
