{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/android-framework/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2025-0098"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Android (framework)"],"_cs_severities":["high"],"_cs_tags":["android","vulnerability","mobile","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Google"],"content_html":"\u003cp\u003eCVE-2025-0098 is a security vulnerability in the Android framework involving an activity token leak. The flaw stems from an insufficient check based solely on the process identifier (PID). This allows an attacker to manipulate activity tokens and execute arbitrary \u003ccode\u003estartActivity()\u003c/code\u003e calls, which could be leveraged to bypass navigation constraints or launch activities with elevated privileges. The vulnerability was officially documented in the February 2025 Android Security Bulletin. A Proof of Concept (PoC) exploit has been published on Sploitus, enabling testing against unpatched versions of the Android framework.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for arbitrary \u003ccode\u003estartActivity()\u003c/code\u003e calls. This could potentially allow an unprivileged application to launch activities that should be restricted, bypass UI security protections, or facilitate further exploitation of the activity management system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and audit applications within the environment that target affected Android framework versions.\u003c/li\u003e\n\u003cli\u003eEnsure that all managed Android devices are updated to the patch level corresponding to the February 2025 security bulletin (commit 61ab2b65caf855c48fdb4166f94e02bf79c90e7b).\u003c/li\u003e\n\u003cli\u003eUse mobile device management (MDM) solutions to verify patch levels and restrict the installation of apps on vulnerable or outdated OS versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T11:01:35Z","date_published":"2026-10-29T11:01:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-android-cve-2025-0098/","summary":"A public Proof of Concept has been released for CVE-2025-0098, an activity token leak vulnerability in the Android framework allowing arbitrary startActivity() calls due to insufficient process identifier validation.","title":"Android Framework: Activity token leak and arbitrary startActivity() (CVE-2025-0098)","url":"https://feed.craftedsignal.io/briefs/2026-10-android-cve-2025-0098/"}],"language":"en","title":"CraftedSignal Threat Feed - Android (Framework)","version":"https://jsonfeed.org/version/1.1"}