CVE-2026-0025: 
NixOS vulnerability analysis and mitigation

CVE-2026-0025 is a permissions bypass vulnerability in the hasImage method of Notification.java in Android that allows a local attacker to reveal information across user accounts and escalate privileges. It affects Android versions 14.0, 15.0, 16.0, and 16.0 QPR2 (including beta variants). The vulnerability was published on March 2, 2026, with a patch included in the Android March 2026 security bulletin. It carries a CVSS v3.1 base score of 8.4 (High) (Android Security Bulletin, Feedly).

The root cause is insufficient access control (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the hasImage method within Notification.java, where permission checks are bypassed, enabling cross-user data exposure. The attack vector is local, requiring no privileges and no user interaction, making it exploitable by any unprivileged local process or application on the device. The flaw allows an attacker to read notification data belonging to other user profiles on a shared or multi-user Android device, and subsequently leverage that access for local privilege escalation (Android Security Bulletin, Feedly).

Successful exploitation allows an unauthenticated local user to read sensitive notification content belonging to other user accounts on the same device, breaching confidentiality across user profiles. Beyond information disclosure, the vulnerability can lead to local escalation of privilege, with high impacts to confidentiality, integrity, and availability as reflected in the CVSS scoring. This is particularly significant on shared or enterprise-managed Android devices where user separation is a security boundary (Android Security Bulletin, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.008% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Google released a patch for CVE-2026-0025 as part of the Android Security Bulletin dated 2026-03-01, covering Android versions 14.0, 15.0, and 16.0 (including QPR2 variants). Device manufacturers such as Samsung and Huawei have incorporated this patch into their March 2026 security updates (Samsung March 2026 Patch, Huawei Bulletin). The recommended remediation is to apply the 2026-03-01 (or later) security patch level on all affected Android devices. Organizations managing shared or multi-user Android devices should prioritize patching given the cross-user data exposure risk (Android Security Bulletin).

The CIS issued an advisory noting multiple vulnerabilities in Google Android OS that could allow for remote code execution and privilege escalation, including CVE-2026-0025 (CIS Advisory). Social media activity was limited, with brief mentions on Mastodon and Bluesky aggregating the bulletin details shortly after publication. No significant independent researcher commentary or media deep-dives have been identified for this specific CVE.