Introduction
On a shared Android device, an attacker can silently view images that belong to other users and get around the platform's user isolation controls. The vulnerability, tracked as CVE-2025-32320, is in Android 16 System UI. It allows local privilege escalation with no user interaction and no additional execution privileges.
Android is the most widely used mobile operating system in the world and runs on billions of smartphones and tablets. Google, its primary developer, handles Android security through monthly bulletins and works with device manufacturers and carriers to distribute patches.
Technical Information
CVE-2025-32320 is a confused deputy vulnerability (CWE-441) in the System UI component of Android 16. A local attacker can use it to view images from other user profiles on the same device. The root cause is improper privilege boundary validation in System UI's media handling routines. When System UI processes an image access request, it does not adequately verify the requesting user's context. A crafted request or manipulated system state can therefore reach images outside the attacker's own profile.
Exploitation needs no user interaction and no additional execution privileges, so a local attacker or a malicious app can exploit the flaw silently. The issue undermines Android's multi-user isolation, which exists to keep each user's data separate on a shared device.
No public code snippets or vulnerable code fragments have been disclosed for this issue.
Patch Information
Google's September 2025 Android Security Bulletin fixed two critical vulnerabilities that were being actively exploited in the wild, CVE-2025-38352 and CVE-2025-48543. (bleepingcomputer.com)
CVE-2025-38352: Kernel Race Condition
This vulnerability was in the Linux kernel's handling of POSIX CPU timers. A race condition between handle_posix_cpu_timers() and posix_cpu_timer_del() could let an attacker escalate privileges or destabilize the system. The patch added synchronization so the two functions cannot run concurrently, which keeps timer operations from overlapping during task exits.
CVE-2025-48543: Android Runtime Privilege Escalation
This flaw was in the Android Runtime (ART). A malicious application could exploit it to gain elevated privileges without user interaction. The fix strengthened the security checks in ART to block unauthorized access and keep applications within their designated privilege levels.
Affected Systems and Versions
- Android 16 System UI is directly affected
- Devices running Android 16 prior to the September 2025 security patch level (2025-09-05) are vulnerable
- Multi-user configurations are specifically at risk
Vendor Security History
Google runs a mature vulnerability management program for Android, publishes monthly security bulletins, and has addressed confused deputy and privilege escalation vulnerabilities before. Similar issues (CWE-441) have been patched in previous Android releases. Google usually patches its own devices promptly, but devices managed by OEMs and carriers can see delays.
