PT-2025-43503 · Unknown · Skiarenderengine

Published 2025-10-23 · Updated 2026-03-06 · CVE-2025-48630

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SkiaRenderEngine (affected versions not specified)

Description A flaw exists in the drawLayersInternal function within SkiaRenderEngine.cpp that may allow access to the GPU cache, potentially revealing side channel information. This could lead to local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-208

Related Identifiers

ASB-A-455563813

CVE-2025-48630

Affected Products

Skiarenderengine

References · 9

• https://source.android.com/docs/security/bulletin/2026/2026-03-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48630 · Security Note
• https://osv.dev/vulnerability/ASB-A-455563813 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48630 · Vendor Advisory
• https://source.android.com/security/bulletin/2026-03-01 · Note
• https://twitter.com/GrapheneOS/status/2015510661019644403 · Twitter Post
• https://twitter.com/cracbot/status/2029874932235317407 · Twitter Post
• https://android.googlesource.com/platform/frameworks/native/+/c81cf361489e3a3cd764c0a0c85c84958e25d63c · Note
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post