CVE-2025-26442: 
NixOS vulnerability analysis and mitigation

CVE-2025-26442 is a local information disclosure vulnerability in Android's NotificationAccessConfirmationActivity.java caused by a logic error in the verification of Notification Listener Service (NLS) intent filters. The flaw exists in the onCreate method and affects Android versions 13.0, 14.0, and 15.0. It was disclosed in the Android Security Bulletin dated May 1, 2025, and published to NVD on September 4, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Android Bulletin).

The root cause is classified as CWE-863 (Incorrect Authorization) — specifically, a logic error in the onCreate method of NotificationAccessConfirmationActivity.java that causes improper verification of intent filters for the Notification Listener Service (NLS). A low-privileged local attacker can exploit this flaw without any user interaction, as the incorrect authorization check allows an app to bypass proper NLS intent filter validation. A patch has been committed to the Android Settings package source repository (Android Bulletin, Android Source).

Successful exploitation leads to local information disclosure with high confidentiality impact — sensitive system or user notification data may be exposed to a low-privileged attacker. There is no impact on integrity or availability, and the scope is unchanged. Lateral movement potential is limited given the local attack vector, but exposure of notification content could reveal sensitive personal or application data (Android Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.009%, reflecting minimal near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only low-privilege local access with no user interaction needed (Android Bulletin).

Google has released a patch as part of the Android Security Bulletin for 2025-05-01, addressing Android versions 13, 14, and 15. The fix is available in the Android Settings package (commit 63f8849244d1817be2729f522a75424c219e9ecb). Users and administrators should apply the latest Android security updates as soon as they are available for their devices. Additionally, restricting local user access and monitoring for unauthorized notification access can reduce risk in the interim (Android Bulletin, Android Source).

The CIS issued an advisory noting multiple vulnerabilities in Google Android OS that could allow for remote code execution and information disclosure, referencing the May 2025 bulletin (CIS Advisory). Samsung also addressed this CVE in its May 2025 security updates for affected devices. No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE.