by Kastro
Paper/Archive/CVE-2025-48626

CVE-2025-48626

Google Android — In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.6.316 × 206.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
Android16–CNA
Android15–CNA
Android14–CNA
Android13–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refandroid.googlesource.com/platform/packages/apps/Launcher3/+/7628af9bf77f1d145359bf4075a6674574cae496refandroid.googlesource.com/platform/frameworks/base/+/9fb37191609f7cb7b2374531cafb2d00ec8b4becrefsource.android.com/security/bulletin/2025-12-01