Request Permission not Working With Android 15 and Security Update May 2025

[kiwi-x]

Hello,

I'm using Cordova Android in combination with the cordova-plugin-android-permissions plugin.

I use it like this;

        permissions.requestPermission(permissions.READ_MEDIA_IMAGES, success, error);
        function error() {
          console.warn('Permissions not granted!');
        }
        function success( status ) {
          if(!status.hasPermission) error();
}

Since the May 2025 security update, the permission request dialog opens, but you can't
submit the dialog anymore.

The only hint I fould was that Google changed something in the Permission Controller

Permission Controller CVE-2025-26420, CVE-2025-26425

See: https://source.android.com/docs/security/bulletin/2025-05-01

But now I'm not shure if it's a common problem or a problem with the plugin.

Does anyone have simular issues or any hints.

Cheers
kiwi-x

PS: I open an issue for the plugin, too:
NeoLSN/cordova-plugin-android-permissions#131

[breautek]

Does the plugin handle declaring the permissions in the manifest? If not you may need to manually add them using <config-file> or <edit-config> directives. If they aren't declared in AndroidManifest.xml then you wouldn't be able to request them during the runtime.

Recent Apache changes may have also caused the problem, as the permissions may have been declared before and is no longer by the plugin(s) you might be using including:

• cordova-plugin-camera
• cordova-plugin-media-capture

Google requires justification for using the new READ_MEDIA permissions (READ_MEDIA_AUDIO, READ_MEDIA_VIDEO, and READ_MEDIA_IMAGES. They are effectively reserved for apps that requires permanent and broad access to media. (Prime example of an app would be a Gallery or a Music Player app).

If you're app is wanting access just to pick a single resource (e.g. for a profile picture or something), Google will likely deny the justification.

So Apache revised the plugin codebases and reworked things so that they didn't require the need for READ_MEDIA_* permissions. For media capture, that means removing the READ_MEDIA as they did nothing that actually warrants using them to begin with.
For camera, READ_MEDIA_IMAGES/READ_MEDIA_VIDEO was necessary if you wanted to allow picking from user gallery. This is primarily caused by the camera plugin following old practices using the file APIs directly to access the content. It has been refactored to use Android's MediaStore APIs which allows for the app to be granted temporarily access to a specific resource file that the user has chosen. READ_MEDIA_* permissions are not necessary, but it does mean the returned URI is short-lived and not permanently accessible.

The blog posts will have more information:

• https://cordova.apache.org/announcements/2025/02/26/cordova-plugin-media-capture-6.0.0.html
• https://cordova.apache.org/announcements/2024/11/02/camera-plugin-camera-8.0.0.html

So it might be worth revising your project to determine if READ_MEDIA_* permissions that you're trying to use is actually necessary.

[kiwi-x]

The required permissions are in the config.xml and AndroidManifest.xml. The required Permissions are requested and granted in Google Play Store Developer console in the app content section. So anything should be fine.

Sadly no other details in the Security Bulletin and the given CVEs are still reserved.

All our apps are affected (TargetSDK 34 and 35) and only on Android 15 May-2025. Any other Android Versions we tested are still working fine. That's why I'm thinking there is a breaking change in the Permission Controller in the May 2025 Update.

But now I'm not shure if it is a possible, general problem for requestPermission in cordova android apps or maybe only a problem with the plugin (but it calls cordova.requestPermissions as well).