CVE-2025-48621CWE-1188

CVE-2025-48621

High · published December 8, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

⚡ A sneaky default setting opens the door to tapjacking! This vulnerability could allow a clever attacker to elevate their privileges locally without breaking a sweat. 🔥 Think of it like a restaurant where the menu has a hidden item that lets you order from the staff's exclusive selection without any checks. If someone knows about this secret, they can get access to dishes they shouldn't be able to order! If exploited, an attacker could gain unauthorized access to sensitive information or functionalities, potentially leading to a complete compromise of the user's account. Even though user interaction is required, the implications could be devastating for those unaware of the sneaky tactic. It's like giving someone the keys to the back office just because they played along with a clever ruse!

Put simply

Think of it like a restaurant where the menu has a hidden item that lets you order from the staff's exclusive selection without any checks. If someone knows about this secret, they can get access to dishes they shouldn't be able to order! This vulnerability in DefaultTransitionHandler.java enables a tapjacking attack due to an insecure default, allowing local privilege escalation without the need for additional execution privileges. Essentially, if a user interacts with a deceptive overlay, an attacker can gain unauthorized access.

What to do

If exploited, an attacker could gain unauthorized access to sensitive information or functionalities, potentially leading to a complete compromise of the user's account. Even though user interaction is required, the implications could be devastating for those unaware of the sneaky tactic. It's like giving someone the keys to the back office just because they played along with a clever ruse! To mitigate this risk, ensure that you review the default settings in your application. Update to the latest version where this vulnerability is patched, and implement additional security checks to verify user interactions before granting access. Make it a priority to educate users about the risks of interacting with unverified overlays! You've got this! By taking these steps, you’ll be on your way to securing your application against this sneaky threat. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00132 · 2.5th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2025-12-08T22:16Z
Affected products (4)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (3)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default
    cvelistv5