In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2025-0086 |
Exploitation
The vulnerability can be exploited locally without any user interaction. An attacker can leverage the missing permission check in the AccountManagerService.java to overwrite the authentication token, leading to potential information disclosure.
Affected Products
- AccountManagerService: Vulnerable due to missing permission checks that allow token overwriting.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper permission checks in the AccountManagerService.java to prevent unauthorized access to authentication tokens.