CVE-2025-48566CWE-20

CVE-2025-48566

High · published December 8, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

⚡ A sneaky input validation flaw allows attackers to bypass user profile boundaries with just a forwarded intent—no extra privileges needed! Think of it like a restaurant where a waiter misdelivers a VIP order to the wrong table, allowing unauthorized diners to enjoy the fancy meal without anyone noticing. 🍽️ This flaw leads to local privilege escalation, letting attackers access and modify sensitive user data they shouldn't have! An attacker could exploit this flaw to gain unauthorized access to sensitive data or system functionalities, effectively elevating their privileges within the system without needing to execute any additional code. This could result in data breaches, unauthorized actions, or even manipulation of other user accounts—all while flying under the radar!

Put simply

Think of it like a restaurant where a waiter misdelivers a VIP order to the wrong table, allowing unauthorized diners to enjoy the fancy meal without anyone noticing. 🍽️ This flaw leads to local privilege escalation, letting attackers access and modify sensitive user data they shouldn't have! This vulnerability arises from improper input validation in multiple locations, allowing an attacker to exploit forwarded intents to bypass user profile boundaries and escalate privileges locally without user interaction.

What to do

An attacker could exploit this flaw to gain unauthorized access to sensitive data or system functionalities, effectively elevating their privileges within the system without needing to execute any additional code. This could result in data breaches, unauthorized actions, or even manipulation of other user accounts—all while flying under the radar! To safeguard against this issue, make sure to validate all incoming data rigorously and implement strict access controls on user profiles. It's crucial to patch to the latest version once available and regularly audit your input validation processes to prevent similar vulnerabilities. 🔧 You've got this! Follow these steps, and you'll keep your system secure and users safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-12-08T22:16Z
Affected products (4)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (1)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation
    cvelistv5