Listen to this Post
The CVE-2025-32328 vulnerability arises from a logic error in multiple functions within the Session.java file of the Android framework. This error occurs during session management when handling image access across different user profiles on a multi-user device. The flaw allows the session logic to incorrectly validate user permissions when retrieving image files from shared storage or private directories. Specifically, when an application requests an image via session functions, the code fails to properly check the user ID associated with the session against the owner of the image data. This bypasses Android’s sandboxing mechanisms designed to isolate user data. The vulnerability leverages the mishandling of intent extras or URI permissions that are passed between components, leading to a confused deputy scenario. As the session functions process image URIs, they do not enforce cross-user boundaries, allowing a malicious app to craft requests that access images belonging to other users. This is possible due to missing checks in functions like `getSession()` or `setImage()` that should validate the calling user’s identity against the target user’s context. The exploit requires no user interaction because the malicious app can execute in the background, invoking session methods with manipulated parameters. The logic error essentially treats all user sessions as equally privileged within the device, ignoring the multi-user security model. This enables local escalation of privilege by allowing a lower-privileged user or app to view sensitive images from another user’s space without any additional execution privileges. The vulnerability is rooted in the Android framework’s codebase, likely affecting versions where session management is used for media handling. The flaw can be triggered through standard API calls that involve session objects and image content providers. Since the error is in the logic flow, it does not rely on memory corruption or typical injection attacks. Instead, it exploits the erroneous assumption that session data is always scoped to the current user. By exploiting this, an attacker can gain unauthorized access to personal images, leading to privacy breaches and potential further exploits through leaked information. The vulnerability is particularly critical because it requires no special permissions and works silently, making detection difficult. It highlights a weakness in Android’s internal permission validation for multi-user environments, where session states are not adequately isolated.
Platform: Android
Version: Multiple versions
Vulnerability: Image cross-user view
Severity: Critical
Date: 12/08/2025
Prediction: Expected patch: December 2025
What Undercode Say:
Analytics
adb shell dumpsys session | grep -i user
pm list users | awk '{print $2}'
logcat | grep -E "Session|ImageAccess"
cat /proc/self/status | grep Uid
am start -n com.example.exploit/.MainActivity
// Sample code snippet to check session vulnerability Session session = getSystemService(Session.class); Uri imageUri = ContentResolver.resolveUserId(uri, otherUserId); ParcelFileDescriptor pfd = session.openImage(imageUri);
how Exploit:
A malicious app creates a session object and manipulates the image URI to reference another user’s private storage. It calls session functions like `openImage()` with the crafted URI, bypassing user ID checks. The app executes silently in the background, requiring no user interaction.
Protection from this CVE
Apply security patches from Android. Restrict session permissions. Implement user ID validation in session functions. Use SELinux policies to enforce isolation. Update to fixed Android versions.
Impact:
Privacy breach via image access. Local privilege escalation. Cross-user data leakage. No user interaction needed. Affects multi-user devices.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
