Introduction
Once a malicious app is installed, attackers can silently record everything displayed on a user's Android device without consent. The risk is real. A critical flaw in Android's MediaProjection permission workflow lets an app bypass the screen recording consent dialog, so sensitive data on screen can be captured without authorization.
Technical Information
CVE-2025-32322 is a high-severity vulnerability (CVSS 7.8) in the Android Framework, in the MediaProjectionPermissionActivity.java component. The MediaProjection API, introduced in Android 5.0, is meant to let apps capture screen and audio content only after the user explicitly approves it in a system dialog. That dialog is an important privacy safeguard. It warns users when an app requests screen recording access.
In Android 13 and 14, improper input validation in the onCreate method of MediaProjectionPermissionActivity.java allows a malicious app to bypass this dialog. By sending crafted input to the activity, an attacker can obtain a valid MediaProjection token without triggering the user consent flow. This is a local privilege escalation. The malicious app needs no special permissions and no user interaction beyond installation. The vulnerability is categorized as CWE-20 (Improper Input Validation).
No public code snippets are available for this issue, but the September 2025 Android Security Bulletin and several external advisories confirm the vulnerability. Its impact is similar to CVE-2018-9524, which affected a majority of Android devices by letting UI overlay attacks trick users into granting screen recording access.
Patch Information
Google fixed CVE-2025-32322 in the September 2025 Android Security Bulletin. The fix is included in security patch level 2025-09-05. Users and organizations should update affected devices to this patch level as soon as possible.
Reference: Android Security Bulletin September 2025
Affected Systems and Versions
- Android 13
- Android 14
Devices running these versions stay vulnerable until they are updated to security patch level 2025-09-05 or later. The flaw is in the MediaProjectionPermissionActivity component as implemented in these Android releases. Available advisories do not confirm any other versions as affected.
Vendor Security History
Google has fixed similar MediaProjection vulnerabilities before, notably CVE-2018-9524, which let attackers use UI overlays to trick users into granting screen recording access. That issue affected over 77 percent of Android devices at the time and exposed the risks in permission workflows for sensitive APIs. Google generally patches core Android vulnerabilities promptly, but fragmentation across the device ecosystem often slows patch adoption across the user base.
