CVE-2025-48594CWE-20

CVE-2025-48594

High · published December 8, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
0.4
In the wild
Unconfirmed
What it is

⚡ A sneaky gap in the DisassociationProcessor could let a rogue app retain its privileges, just like a former employee keeping their office key! 🔑 Think of it like a restaurant allowing a waiter to keep their access card even after they've stopped working there. With that card, they could still waltz into the kitchen and mess with orders! An attacker could exploit this vulnerability to escalate privileges locally without needing any additional permissions. This could lead to unauthorized access to sensitive information, allowing them to manipulate data or perform actions they shouldn't be able to. It's a recipe for disaster if left unchecked!

Put simply

Think of it like a restaurant allowing a waiter to keep their access card even after they've stopped working there. With that card, they could still waltz into the kitchen and mess with orders! This vulnerability arises from improper input validation in the onUidImportance function of DisassociationProcessor.java, which allows retained privileges even after disassociation of a companion application. User interaction is required for the exploit to take place, making it a targeted attack opportunity.

What to do

An attacker could exploit this vulnerability to escalate privileges locally without needing any additional permissions. This could lead to unauthorized access to sensitive information, allowing them to manipulate data or perform actions they shouldn't be able to. It's a recipe for disaster if left unchecked! Update the affected software to the latest version where this input validation issue has been resolved. Additionally, review your access control policies and user permissions to ensure that no lingering privileges are granted unnecessarily. Don't forget to educate users about the risks involved! You've got this! By taking these steps, you can strengthen your defenses and show those vulnerabilities who's boss! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00091 · 0.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-12-08T22:16Z
Affected products (3)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (2)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper…
    cvelistv5