PT-2025-36052 · Unknown · Chooseractivity

Published 2025-09-01 · Updated 2025-09-05 · CVE-2025-48526

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ChooserActivity (affected versions not specified)

Description An application may launch the ChooserActivity in another profile due to improper input validation within the createMultiProfilePagerAdapter function of ChooserActivity.java. This could lead to local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

ASB-A-407764858

BDU:2025-11579

CVE-2025-48526

Affected Products

Chooseractivity

References · 10

• https://android.googlesource.com/platform/packages/modules/IntentResolver/+/923a5673ac9d4b366097a8912a04e40e85111ed4 · Patch
• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11579 · Security Note
• https://osv.dev/vulnerability/ASB-A-407764858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48526 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48526 · Vendor Advisory
• https://android.googlesource.com/platform/packages/modules/IntentResolver/+/247af9e3e487aabb03d7aad79f71e9f78571d142 · Note
• https://twitter.com/CVEnew/status/1963827288107339868 · Twitter Post
• https://t.me/cveNotify/134441 · Telegram Post
• https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01 · Note