CVE-2025-8192
Race condition in AndroidTV TvSettings
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jul 31, 2025
- Updated
- Jul 31, 2025
- Reserved
- Jul 25, 2025
Description
There exists a TOCTOU race condition in TvSettings AppRestrictionsFragment.java that lead to start of attacker supplied activity in Settings’ context, i.e. system-uid context, thus lead to launchAnyWhere. The core idea is to utilize the time window between the check of Intent and the use to Intent to change the target component’s state, thus bypass the original security sanitize function.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N |
Weaknesses
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Products
| Product | Versions |
|---|---|
TVAndroid |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.