Overview

This report introduces and details CVE-2025-32347, a significant vulnerability identified in the onStart method of BiometricEnrollIntroduction.java. This flaw presents a potential threat to users who may find their device’s location compromised due to an unsafe PendingIntent. It is of considerable concern as it could potentially lead to a local escalation of privilege without any additional execution privileges needed, thus leaving systems and user data at risk.

Vulnerability Summary

CVE ID: CVE-2025-32347
Severity: High (7.8)
Attack Vector: Local
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Android Operating System | Various versions (specific versions not provided)

How the Exploit Works

The vulnerability arises from an unsafe PendingIntent in the onStart method of BiometricEnrollIntroduction.java. An attacker exploiting this flaw can potentially determine the device’s location, resulting in a local escalation of privilege. This exploit does not require any additional execution privileges and only needs user interaction to be successfully activated.

Conceptual Example Code

The following is a hypothetical example of how an attacker might exploit this vulnerability:

Intent intent = new Intent(context, VulnerableClass.class);
PendingIntent pendingIntent = PendingIntent.getActivity(context, 0, intent, PendingIntent.FLAG_UPDATE_CURRENT);
// The attacker would then trigger the PendingIntent
try {
pendingIntent.send();
} catch (PendingIntent.CanceledException e) {
e.printStackTrace();
}

In this conceptual example, the attacker creates an Intent pointing to a vulnerable class and then creates a PendingIntent with that Intent. By sending the PendingIntent, the attacker could potentially trigger the vulnerability and determine the device’s location.