CVE-2025-26419: 
NixOS vulnerability analysis and mitigation

CVE-2025-26419 is a Factory Reset Protection (FRP) bypass vulnerability in Android's SystemSettingsFragment.java, specifically in the initPhoneSwitch method. A logic error in the code allows a local attacker to bypass FRP protections, leading to local escalation of privilege on affected devices. The vulnerability affects Android 13.0 and 14.0. It was published on September 4, 2025, and carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat CVE).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), stemming from a logic error in the initPhoneSwitch method of SystemSettingsFragment.java in the Android framework. This flaw allows an attacker with physical access to a device to bypass the Factory Reset Protection mechanism — a security feature designed to prevent unauthorized use of a device after a factory reset. Exploitation requires user interaction but no additional execution privileges, and the attack vector is local (Red Hat CVE).

Successful exploitation allows a local attacker to bypass FRP and gain unauthorized access to a locked Android device, resulting in a local escalation of privilege. The primary impact is a confidentiality breach (low), as the attacker can access device data that would otherwise be protected by FRP. Integrity and availability are not directly impacted by this vulnerability (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-26419. The EPSS score is extremely low at approximately 0.009%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires physical access to the device and user interaction, significantly limiting the attack surface (Red Hat CVE).

Users and administrators should apply the Android security patch released by Google in September 2025 that addresses this vulnerability. Devices running Android 13.0 or 14.0 should be updated to the latest available security patch level. As a general precaution, physical access to devices should be restricted, and device management policies (e.g., MDM) should enforce timely patch deployment (Red Hat CVE).