PT-2025-49580 · Google · Android

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-48606

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the preparePackage function within InstallPackageHelper.java that may allow an application to install in a hidden state without providing a means for uninstallation. This is due to a logic error in the code. Exploitation does not require user interaction and can lead to local escalation of privilege without needing additional execution privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-48606

Affected Products

Android

References · 6

• https://source.android.com/security/bulletin/android-16-qpr2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48606 · Security Note
• https://twitter.com/CVEnew/status/1998088450747109731 · Twitter Post
• https://t.me/CVEtracker/39146 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1998170043872420192 · Twitter Post