CVE-2025-36904

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384

Critical · published September 4, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

🚨 A sneaky flaw in Android's WLAN can elevate privileges like a VIP pass at a concert - if you’ve got it, you’re in! 🔥 Think of it like a backstage door that anyone can slip through, bypassing the regular checks. Once inside, you can access areas and information meant only for the crew, posing serious risks to the system. This vulnerability could allow an attacker with low-level access to gain elevated privileges, potentially leading to unauthorized control over the device and its data. With a CVSS score of 9.8, the stakes are incredibly high - your entire device could be compromised if exploited!

Put simply

Think of it like a backstage door that anyone can slip through, bypassing the regular checks. Once inside, you can access areas and information meant only for the crew, posing serious risks to the system. The vulnerability in the WLAN subsystem of Android, prior to the September 2025 update, allows for privilege escalation due to improper checks, meaning lower-level users can gain higher-level access to sensitive features and data.

What to do

This vulnerability could allow an attacker with low-level access to gain elevated privileges, potentially leading to unauthorized control over the device and its data. With a CVSS score of 9.8, the stakes are incredibly high - your entire device could be compromised if exploited! Immediately update your Google Pixel devices to the latest firmware released after September 2025 to patch this vulnerability. Regularly check for updates to ensure you're protected against evolving threats. You've got this! Stay vigilant and keep your devices updated for maximum security. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Published
2025-09-04T04:58Z
EPSS history
Timeline
  • 04 SEP 04:58Z
    WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384
    cvelistv5