CVE-2025-48620

CVE-2025-48620

High · published December 8, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.6
In the wild
Unconfirmed
What it is

⚡ A sneaky logic error means that even after uninstalling a third-party app, its component can still linger on your system like a party guest that just won’t leave! 🚪 Think of it like a restaurant that doesn't clear out the old reservation once you cancel — the table is still marked as booked even when you're not there anymore. This bug lets malicious apps retain their presence, risking your security. An attacker could exploit this vulnerability to gain local administrative privileges without needing any extra permissions or user interactions. This could lead to unauthorized access to sensitive data, file manipulations, or even remote controls over features, putting your device at considerable risk.

Put simply

Think of it like a restaurant that doesn't clear out the old reservation once you cancel — the table is still marked as booked even when you're not there anymore. This bug lets malicious apps retain their presence, risking your security. This vulnerability in VoiceInteractionManagerService.java allows a third-party application's component name to persist even after the app is uninstalled due to a logic error. This flaw can enable local privilege escalation without any extra execution privileges needed.

What to do

An attacker could exploit this vulnerability to gain local administrative privileges without needing any extra permissions or user interactions. This could lead to unauthorized access to sensitive data, file manipulations, or even remote controls over features, putting your device at considerable risk. To mitigate this issue, ensure you update your system to the latest available version that addresses CVE-2025-48620. Additionally, review permissions granted to third-party applications and regularly audit installed apps to ensure no unwanted components linger on your device. You've got this! Stay vigilant and follow these steps to keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00095 · 0.6th percentile
Published
2025-12-08T22:16Z
Affected products (4)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (3)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after…
    cvelistv5