CVE-2025-48572KEV · OVERDUECWE-306

Android Framework Privilege Escalation Vulnerability

High · published December 8, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 16.6th percentile for exploit probability.

305
days past CISA
deadline
CVSS v3.1
7.8
EPSS
0%
Percentile
16.6
In the wild
Confirmed
What it is

⚡ A permissions bypass lurking in multiple spots can unleash a world of trouble! Users are blissfully unaware while attacks can escalate privileges in the background — no interaction needed! 🔥 Think of it like a delivery person sneaking through a back door instead of ringing the doorbell, accessing all your prized possessions without you ever knowing they were there. This sneaky exploit can make a cozy home feel incredibly unsafe! An attacker could effortlessly elevate their privileges, gaining access to sensitive data and critical system controls without raising alarms. This could lead to absolutely devastating consequences, including unauthorized access to user accounts, data theft, or even system sabotage!

Put simply

Think of it like a delivery person sneaking through a back door instead of ringing the doorbell, accessing all your prized possessions without you ever knowing they were there. This sneaky exploit can make a cozy home feel incredibly unsafe! This vulnerability allows an attacker to launch activities from the background by bypassing permission checks, meaning they can execute actions normally limited to privileged users without requiring any additional execution privileges.

What to do

An attacker could effortlessly elevate their privileges, gaining access to sensitive data and critical system controls without raising alarms. This could lead to absolutely devastating consequences, including unauthorized access to user accounts, data theft, or even system sabotage! To protect your systems, patch to the latest version immediately and review permission configurations to ensure proper access controls are in place. Regularly audit your application for other potential vulnerabilities to prevent future issues. You've got this! Tackle this vulnerability head-on and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-08T22:16Z
KEV added
2025-12-02 · due 2025-12-23
Affected products (4)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (3)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass
    cvelistv5
  • 02 DEC 00:00Z
    Added to CISA KEV — remediate by Dec 23
    kev