{"id":"ASB-A-376028556","details":"In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-376028556","CVE-2025-22441"],"modified":"2026-03-11T06:30:33.838089Z","published":"2025-08-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-08-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-08-01"}]}],"versions":["16-next"],"ecosystem_specific":{"fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/352fb4821076f0209ab2092d53444503dcec8992","https://googleplex-android.googlesource.com/platform/frameworks/base/+/37bf5823504f2a256f128123393cd149721b87fc"],"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","id":"ASB-A-376028556-80d9f5d2","digest":{"threshold":0.9,"line_hashes":["318234594094662068002484417868747089067","182386947253532100009025391654763344194","87677038499845687213759823017604232290","24507967960209582836110983789526298922","162279423724481408727853140535117008086","152892033948652236101092164971107106443","151376004588425644154129250688686084968","132574641805704742144565948179957075728","310283217575139308559335674527561256947"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/352fb4821076f0209ab2092d53444503dcec8992","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-9669786f","digest":{"length":567,"function_hash":"110759443643256904480438560228588026615"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/352fb4821076f0209ab2092d53444503dcec8992","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-b69708e9","digest":{"threshold":0.9,"line_hashes":["84484373518894387911584593931132927087","93670588842877633913137203373506632018","167507575764890214064131824667935172071","330670205545994997749963707185099131062","195917442012834482912918296902701406262","212942900104374883755297734187311322641","14634178386523754295676520909094304743"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/37bf5823504f2a256f128123393cd149721b87fc","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-cdeb3bc4","digest":{"length":608,"function_hash":"287949419893118345749572534792311138713"},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java","function":"getRemoteContextEnsuringCorrectCachedApkPath"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/352fb4821076f0209ab2092d53444503dcec8992","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-ce79396a","digest":{"length":646,"function_hash":"257213081514596335773029329328861159102"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/37bf5823504f2a256f128123393cd149721b87fc","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-ef8bb344","digest":{"threshold":0.9,"line_hashes":["60572629492590297840456768738415091448","144323628469773383207646836358154214589","56100440564626564148927788202225199279","182457261934353766884995230083905103433","162971304618568272302697295564415965188","188876170376131029959506706797995509482","139233690523893845817630690491165993601","265034440336697184124993520094900138660","245332457772070601353817074430416317292"]},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/352fb4821076f0209ab2092d53444503dcec8992","signature_version":"v1"}],"severity":"High","spl":"2025-08-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-376028556.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-08-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/f2251f1222e59b68d083a016bcc07d7c96980aab","https://googleplex-android.googlesource.com/platform/frameworks/base/+/1e9f4e8998cc934699405bbe0779b706cfb43905"],"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","id":"ASB-A-376028556-08659c33","digest":{"threshold":0.9,"line_hashes":["60572629492590297840456768738415091448","144323628469773383207646836358154214589","56100440564626564148927788202225199279","182457261934353766884995230083905103433","162971304618568272302697295564415965188","188876170376131029959506706797995509482","139233690523893845817630690491165993601","265034440336697184124993520094900138660","245332457772070601353817074430416317292"]},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/f2251f1222e59b68d083a016bcc07d7c96980aab","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-a85306d1","digest":{"threshold":0.9,"line_hashes":["84484373518894387911584593931132927087","93670588842877633913137203373506632018","167507575764890214064131824667935172071","330670205545994997749963707185099131062","195917442012834482912918296902701406262","212942900104374883755297734187311322641","14634178386523754295676520909094304743"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1e9f4e8998cc934699405bbe0779b706cfb43905","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-be830f53","digest":{"length":646,"function_hash":"257213081514596335773029329328861159102"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/1e9f4e8998cc934699405bbe0779b706cfb43905","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-db015abd","digest":{"length":498,"function_hash":"44267461180890547027152803667894507120"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/f2251f1222e59b68d083a016bcc07d7c96980aab","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-df3a1fb2","digest":{"threshold":0.9,"line_hashes":["318234594094662068002484417868747089067","182386947253532100009025391654763344194","87677038499845687213759823017604232290","24507967960209582836110983789526298922","162279423724481408727853140535117008086","75830114779997666176380992247571000424","49993412477641560706602780063922255274","23180009778622539445744752984951650682","313977016376867192122004067118789107723","212459228085423789148790693478525358025"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/f2251f1222e59b68d083a016bcc07d7c96980aab","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-ff9a8e98","digest":{"length":608,"function_hash":"287949419893118345749572534792311138713"},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java","function":"getRemoteContextEnsuringCorrectCachedApkPath"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/f2251f1222e59b68d083a016bcc07d7c96980aab","signature_version":"v1"}],"severity":"High","spl":"2025-08-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-376028556.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-08-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","https://googleplex-android.googlesource.com/platform/frameworks/base/+/74decaab6437094783853b531a5c6538cce8f58f"],"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","id":"ASB-A-376028556-0ccdf45e","digest":{"threshold":0.9,"line_hashes":["84484373518894387911584593931132927087","93670588842877633913137203373506632018","167507575764890214064131824667935172071","330670205545994997749963707185099131062","195917442012834482912918296902701406262","212942900104374883755297734187311322641","14634178386523754295676520909094304743"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/74decaab6437094783853b531a5c6538cce8f58f","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-22d0165a","digest":{"length":608,"function_hash":"287949419893118345749572534792311138713"},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java","function":"getRemoteContextEnsuringCorrectCachedApkPath"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-286faa9d","digest":{"threshold":0.9,"line_hashes":["60572629492590297840456768738415091448","144323628469773383207646836358154214589","56100440564626564148927788202225199279","182457261934353766884995230083905103433","162971304618568272302697295564415965188","188876170376131029959506706797995509482","139233690523893845817630690491165993601","265034440336697184124993520094900138660","245332457772070601353817074430416317292"]},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-4e397d82","digest":{"threshold":0.9,"line_hashes":["318234594094662068002484417868747089067","182386947253532100009025391654763344194","87677038499845687213759823017604232290","24507967960209582836110983789526298922","162279423724481408727853140535117008086","75830114779997666176380992247571000424","49993412477641560706602780063922255274","23180009778622539445744752984951650682","313977016376867192122004067118789107723","212459228085423789148790693478525358025"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-7c68b405","digest":{"length":646,"function_hash":"257213081514596335773029329328861159102"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/74decaab6437094783853b531a5c6538cce8f58f","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-7f8bb76e","digest":{"length":498,"function_hash":"44267461180890547027152803667894507120"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"}],"severity":"High","spl":"2025-08-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-376028556.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-08-01"}]}],"versions":["14"],"ecosystem_specific":{"fixes":["https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","https://googleplex-android.googlesource.com/platform/frameworks/base/+/74decaab6437094783853b531a5c6538cce8f58f"],"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","id":"ASB-A-376028556-0724cf3f","digest":{"threshold":0.9,"line_hashes":["318234594094662068002484417868747089067","182386947253532100009025391654763344194","87677038499845687213759823017604232290","24507967960209582836110983789526298922","162279423724481408727853140535117008086","75830114779997666176380992247571000424","49993412477641560706602780063922255274","23180009778622539445744752984951650682","313977016376867192122004067118789107723","212459228085423789148790693478525358025"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-072b73f5","digest":{"length":498,"function_hash":"44267461180890547027152803667894507120"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-293edf15","digest":{"threshold":0.9,"line_hashes":["60572629492590297840456768738415091448","144323628469773383207646836358154214589","56100440564626564148927788202225199279","182457261934353766884995230083905103433","162971304618568272302697295564415965188","188876170376131029959506706797995509482","139233690523893845817630690491165993601","265034440336697184124993520094900138660","245332457772070601353817074430416317292"]},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"},{"signature_type":"Line","id":"ASB-A-376028556-3f687a19","digest":{"threshold":0.9,"line_hashes":["84484373518894387911584593931132927087","93670588842877633913137203373506632018","167507575764890214064131824667935172071","330670205545994997749963707185099131062","195917442012834482912918296902701406262","212942900104374883755297734187311322641","14634178386523754295676520909094304743"]},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/74decaab6437094783853b531a5c6538cce8f58f","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-b15457d7","digest":{"length":646,"function_hash":"257213081514596335773029329328861159102"},"deprecated":false,"target":{"file":"core/java/android/widget/RemoteViews.java","function":"getContextForResourcesEnsuringCorrectCachedApkPaths"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/74decaab6437094783853b531a5c6538cce8f58f","signature_version":"v1"},{"signature_type":"Function","id":"ASB-A-376028556-ec71032f","digest":{"length":608,"function_hash":"287949419893118345749572534792311138713"},"deprecated":false,"target":{"file":"core/java/android/appwidget/AppWidgetHostView.java","function":"getRemoteContextEnsuringCorrectCachedApkPath"},"source":"https://googleplex-android.googlesource.com/platform/frameworks/base/+/85985722a6e7b3eee16be2e66e170f83f37f6561","signature_version":"v1"}],"severity":"High","spl":"2025-08-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv-test/ASB-A-376028556.json"}}],"schema_version":"1.7.5"}