CVE-2025-48606

CVE-2025-48606

High · published December 8, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.5
In the wild
Unconfirmed
What it is

🚨 A sneaky logic flaw allows an app to install invisibly, leaving users with no option to uninstall it! ⚡ Imagine a magician who performs a trick so well that their assistant vanishes without a trace, and now there's no way to bring them back. That’s what’s happening here; the app can hide itself upon installation, just like a disappearing act that has no encore! This vulnerability could lead to a chilling situation where malicious apps gain local privilege escalation without detection—like a thief slipping into your house unnoticed and making themselves at home. Once in, they can manipulate your device without you even knowing it, potentially leading to data theft or unauthorized access to your accounts.

Put simply

Imagine a magician who performs a trick so well that their assistant vanishes without a trace, and now there's no way to bring them back. That’s what’s happening here; the app can hide itself upon installation, just like a disappearing act that has no encore! The issue resides in the 'preparePackage' method of InstallPackageHelper.java, where a logic error enables apps to install without being visible to the user or providing an uninstallation option, ultimately allowing for local privilege escalation without needing any execution privileges.

What to do

This vulnerability could lead to a chilling situation where malicious apps gain local privilege escalation without detection—like a thief slipping into your house unnoticed and making themselves at home. Once in, they can manipulate your device without you even knowing it, potentially leading to data theft or unauthorized access to your accounts. To secure your systems, ensure that you update to the fixed version of the software as soon as it is available. Additionally, review permissions associated with app installations and consider implementing stricter checks to prevent unauthorized apps from gaining visibility and permissions. Regularly audit your app ecosystem to catch any hidden threats! You've got this! Stay vigilant and proactive, and you’ll keep your system secure. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00091 · 0.5th percentile
Published
2025-12-08T23:15Z
Affected products (1)
ProductVersionsFixed in
google/androidall versions—
References (1)
EPSS history
Timeline
  • 08 DEC 17:27Z
    In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due…
    cvelistv5