PT-2025-43495 · Google · Android

Published 2025-10-23 · Updated 2025-12-09 · CVE-2025-48618

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. This could allow an attacker to escalate privileges. Specifically, the issue resides in the processLaunchBrowser function within CommandParamsFactory.java, where improper locking may allow browser interaction from the lockscreen. Exploitation does not require user interaction and could lead to physical escalation of privilege without needing additional execution privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

RCE

Improper Locking

Weakness Enumeration

CWE-20

CWE-667

Related Identifiers

ASB-A-404254549

BDU:2025-15133

CVE-2025-48618

Affected Products

Android

References · 10

• https://android.googlesource.com/platform/frameworks/opt/telephony/+/fee68bcdcf029e8f40980616d09367610544bc62 · Patch
• https://bdu.fstec.ru/vul/2025-15133 · Security Note
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48618 · Security Note
• https://osv.dev/vulnerability/ASB-A-404254549 · Vendor Advisory
• https://source.android.com/docs/security/bulletin/2025-12-01?hl=ru · Note
• https://twitter.com/CVEnew/status/1998079573213208794 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1998223800731603311 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post