CVE-2025-48639CWE-1021

CVE-2025-48639

High · published December 8, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
0.9
In the wild
Unconfirmed
What it is

⚡ A tapjacking attack could turn your device into an unintentional enabler! This vulnerability in DefaultTransitionHandler.java could allow apps to gain permissions without you even realizing it. 🔥 Imagine someone placing a fake order in a restaurant while you’re distracted, making it seem like you approved their meal. In the same way, this vulnerability allows an attacker to grant app permissions by cleverly overlaying themselves on your screen, tricking you into granting access without your knowledge. This means that an attacker could gain local escalated privileges with just a simple tap from you! If they exploit this vulnerability, they might access sensitive information or even control certain functions of your device. The consequences could be quite serious if your device falls into the wrong hands.

Put simply

Imagine someone placing a fake order in a restaurant while you’re distracted, making it seem like you approved their meal. In the same way, this vulnerability allows an attacker to grant app permissions by cleverly overlaying themselves on your screen, tricking you into granting access without your knowledge. The vulnerability is due to a lack of adequate protections against tapjacking/overlay attacks in DefaultTransitionHandler.java, which allows malicious apps to gain unauthorized permissions through user interaction, with no additional execution privileges required.

What to do

This means that an attacker could gain local escalated privileges with just a simple tap from you! If they exploit this vulnerability, they might access sensitive information or even control certain functions of your device. The consequences could be quite serious if your device falls into the wrong hands. To secure your systems, ensure that the affected version of your app is updated. Implement measures to verify the authenticity of overlays and educate users about potential social engineering attacks that might lead to exploitation. Regularly review permission settings on your devices! You've got this! By staying informed and proactive, you can make your digital world a safer place! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00103 · 0.9th percentile
Weakness
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames
Published
2025-12-08T22:16Z
Affected products (4)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (3)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack
    cvelistv5