Android Framework: Activity token leak and arbitrary startActivity() (CVE-2025-0098)

CVE-2025-0098 is a security vulnerability in the Android framework involving an activity token leak. The flaw stems from an insufficient check based solely on the process identifier (PID). This allows an attacker to manipulate activity tokens and execute arbitrary startActivity() calls, which could be leveraged to bypass navigation constraints or launch activities with elevated privileges. The vulnerability was officially documented in the February 2025 Android Security Bulletin. A Proof of Concept (PoC) exploit has been published on Sploitus, enabling testing against unpatched versions of the Android framework.

Impact

The vulnerability allows for arbitrary startActivity() calls. This could potentially allow an unprivileged application to launch activities that should be restricted, bypass UI security protections, or facilitate further exploitation of the activity management system.

Recommendation

• Identify and audit applications within the environment that target affected Android framework versions.
• Ensure that all managed Android devices are updated to the patch level corresponding to the February 2025 security bulletin (commit 61ab2b65caf855c48fdb4166f94e02bf79c90e7b).
• Use mobile device management (MDM) solutions to verify patch levels and restrict the installation of apps on vulnerable or outdated OS versions.