CVE-2025-26418: Android CarDevicePolicyService Privilege Escalation (CVSS 7.8)

Technical summary

CVE-2025-26418 is a privilege escalation vulnerability in the setUserDisclaimerAcknowledged method of CarDevicePolicyService.java. The vulnerability exploits inadequate authorization controls (CWE-862: Missing Authorization) to circumvent the user acknowledgment dialog that gates account provisioning on device policy-managed Android systems. An app running with standard user privileges can invoke this method without the required permission enforcement, allowing direct manipulation of account addition workflows. The attack surface is local only, execution is straightforward, and no user interaction is needed.

Business impact

This vulnerability directly threatens the security posture of organizations deploying Android as a managed platform, particularly in automotive and IoT contexts where CarDevicePolicyService operates. An attacker could silently add accounts under victim or attacker control to a managed device, gaining persistent access to corporate data and credentials without detection. For enterprises relying on device management policies to enforce security controls, this represents a significant control bypass that undermines the entire managed device trust model.

Affected systems

Google Android devices running versions of the OS that include the CarDevicePolicyService component. The vulnerability affects the device policy management framework broadly, though the specific vulnerable versions have not been detailed in the source data. Organizations should verify their Android version and device policy implementation status directly with vendor advisories.

Exploitability

Exploitability is high. The vulnerability requires only local access (app installation) and baseline user privileges—no special permissions, root access, or elevated context is needed. The attack is reliable and deterministic because it bypasses a permission check entirely rather than exploiting a logic flaw. The absence of a user interaction requirement means the exploit can run silently in the background. However, the attacker must first install an app on the device, which represents a gating factor in many enterprise environments with app control policies.

Remediation

Organizations should prioritize patching affected Android devices to versions that include the missing permission check in CarDevicePolicyService. Until patches are applied, restrict app installation via device policy to prevent untrusted applications from reaching the vulnerable code path. Monitor for unexpected account additions on managed devices and review access logs for suspicious setUserDisclaimerAcknowledged method invocations.

Patch guidance

Apply the latest Android security patch as released by Google for your device model and operating system version. Verify patch status by cross-referencing your Android version against the official Google Security & Privacy bulletin for June 2026 and later. Test patches in a non-production environment before enterprise rollout, particularly if using CarDevicePolicyService in custom device management implementations.

Detection guidance

Monitor application behavior for calls to the setUserDisclaimerAcknowledged method without corresponding user confirmation dialogs. Implement Mobile Device Management (MDM) log analysis to detect unexpected account additions on managed devices, particularly accounts that bypass the normal provisioning workflow. Security event logs should flag instances where device policy management APIs are invoked by apps lacking appropriate manifest permissions. On-device audit logging of account management changes provides an additional detection layer.

Why prioritize this

This vulnerability earns HIGH priority due to its CVSS score of 7.8, the complete confidentiality, integrity, and availability impact (C:H, I:H, A:H), and the realistic attack scenario. Unlike many privilege escalations that require complex exploitation chains or elevated starting privileges, this flaw is trivial to exploit locally with minimal attacker requirements. For organizations using Android device management, this directly undermines their security controls. The absence of KEV designation should not lower urgency—patch adoption typically lags public disclosure, creating an exploitation window.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L), low complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability. The score appropriately captures the threat model—a standard app on a device can escalate privileges to bypass critical security controls without user awareness. Organizations managing sensitive data on Android devices should treat this as a control plane vulnerability requiring rapid remediation.

Frequently asked questions