Overview
This report introduces and details CVE-2025-32347, a significant vulnerability identified in the onStart method of BiometricEnrollIntroduction.java. This flaw presents a potential threat to users who may find their device’s location compromised due to an unsafe PendingIntent. It is of considerable concern as it could potentially lead to a local escalation of privilege without any additional execution privileges needed, thus leaving systems and user data at risk.
Vulnerability Summary
CVE ID: CVE-2025-32347
Severity: High (7.8)
Attack Vector: Local
Privileges Required: None
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Android Operating System | Various versions (specific versions not provided)
How the Exploit Works
The vulnerability arises from an unsafe PendingIntent in the onStart method of BiometricEnrollIntroduction.java. An attacker exploiting this flaw can potentially determine the device’s location, resulting in a local escalation of privilege. This exploit does not require any additional execution privileges and only needs user interaction to be successfully activated.
Conceptual Example Code
The following is a hypothetical example of how an attacker might exploit this vulnerability:
Intent intent = new Intent(context, VulnerableClass.class);
PendingIntent pendingIntent = PendingIntent.getActivity(context, 0, intent, PendingIntent.FLAG_UPDATE_CURRENT);
// The attacker would then trigger the PendingIntent
try {
pendingIntent.send();
} catch (PendingIntent.CanceledException e) {
e.printStackTrace();
}In this conceptual example, the attacker creates an Intent pointing to a vulnerable class and then creates a PendingIntent with that Intent. By sending the PendingIntent, the attacker could potentially trigger the vulnerability and determine the device’s location.
