CVE-2025-32347: 
NixOS vulnerability analysis and mitigation

CVE-2025-32347 is a local privilege escalation vulnerability in Android's Settings application, specifically in the onStart method of BiometricEnrollIntroduction.java, caused by an unsafe PendingIntent. It affects Android versions 13.0, 14.0, 15.0, and 16.0. The vulnerability is classified as CWE-926 (Improper Export of Android Application Components) and was publicly disclosed on September 4, 2025, as part of Google's September 2025 Android Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin).

The root cause is an improperly configured PendingIntent in the onStart method of BiometricEnrollIntroduction.java within the Android Settings application (CWE-926: Improper Export of Android Application Components). An unsafe PendingIntent can be intercepted or hijacked by a malicious application on the same device, allowing it to be redirected to perform unintended actions — in this case, potentially exposing the device's location or escalating local privileges. Exploitation requires user interaction (e.g., triggering the biometric enrollment flow) but no additional execution privileges beyond those of a standard installed application (Android Security Bulletin, Android Patch).

Successful exploitation could allow a malicious local application to determine the device's physical location and escalate privileges locally without requiring elevated permissions. The vulnerability affects the confidentiality, integrity, and availability of the device, as indicated by the CVSS v3.1 scores of High across all three impact categories. The broad scope across Android 13 through 16 makes this a widespread concern for Android device users globally (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000090, reflecting a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction to trigger the biometric enrollment flow, which somewhat limits opportunistic exploitation (Android Security Bulletin).

1. Install malicious app: An attacker installs a malicious application on the target Android device (versions 13–16) that does not require special permissions beyond those of a standard app.
2. Monitor for PendingIntent: The malicious app registers to intercept or hijack the unsafe PendingIntent broadcast by BiometricEnrollIntroduction.java when the biometric enrollment activity starts.
3. Trigger enrollment flow: The attacker socially engineers the victim into initiating the biometric enrollment process (e.g., via a prompt or notification), causing onStart to execute and the unsafe PendingIntent to be dispatched.
4. Intercept PendingIntent: The malicious app captures the improperly exported PendingIntent and redirects it to perform unauthorized actions, such as accessing location data or executing privileged operations.
5. Achieve objective: The attacker obtains the device's location information or achieves local privilege escalation, potentially enabling further access to sensitive device resources (Android Security Bulletin, Android Patch).

• Logs: Unexpected access to location services originating from the Settings application or biometric enrollment activity; Android system logs showing PendingIntent dispatches from BiometricEnrollIntroduction to unexpected receivers.
• Process/Application Behavior: A third-party application receiving or acting on PendingIntents associated with the biometric enrollment flow; unusual location access events logged in Android's privacy dashboard attributed to the Settings app.
• Network: Unexpected outbound connections from a device shortly after biometric enrollment is initiated, potentially indicating data exfiltration of location information.

Google released a patch for CVE-2025-32347 in the September 2025 Android Security Bulletin (security patch level 2025-09-01), covering Android versions 13, 14, 15, and 16. The specific fix is available in the Android Open Source Project commit for packages/apps/Settings. Users and administrators should apply the September 2025 security patch immediately to all affected Android devices. As a general precaution, restrict installation of untrusted third-party applications and review app permissions regularly (Android Security Bulletin, Android Patch).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in the September 2025 Android bulletin, including CVE-2025-32347, could allow for remote code execution and privilege escalation (CIS Advisory). Samsung acknowledged the bulletin in the context of its August/September 2025 security patch updates for Galaxy devices (SammyFans). No significant independent researcher commentary or social media discussion specific to this CVE has been identified.