CVE-2025-22434: 
NixOS vulnerability analysis and mitigation

In handleKeyGestureEvent of PhoneWindowManager.java in Android versions 14.0 and 15.0, there is a possible lock screen bypass due to a logic error in the code. This vulnerability was disclosed in the April 2025 Android Security Bulletin (Android Bulletin).

The vulnerability exists in the PhoneWindowManager.java component and specifically affects the handleKeyGestureEvent function. The issue stems from a logic error that could allow bypassing the lock screen security mechanism. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (High), with attack vector being Local (L), requiring low privileges (PR:L), and no user interaction (UI:N) needed for exploitation (AttackerKB).

This vulnerability could lead to local escalation of privilege with no additional execution privileges needed. The successful exploitation would allow an attacker to bypass the lock screen security mechanism, potentially gaining unauthorized access to the device (Debian Tracker).

Google has released a patch to address this vulnerability in the Android Security Bulletin for April 2025. The fix involves blocking the opening of settings app on keyguard without user authentication, as evidenced by the commit 2880f0ab2dc63dc6ea820afb79e9be523ecb7074 (Android Source).