PT-2026-5349 · Google · Android+1

Published 2026-01-29 · Updated 2026-03-02 · CVE-2025-48635

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A logic error in multiple functions of TaskFragmentOrganizerController.java may cause an activity token leak. This issue allows for local escalation of privilege without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Protection Mechanism Failure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-693

CWE-532

Related Identifiers

ASB-A-446678690

CVE-2025-48635

Affected Products

Android

Platform/Frameworks/Base

References · 6

• https://osv.dev/vulnerability/ASB-A-446678690 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48635 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48635 · Vendor Advisory
• https://source.android.com/docs/security/bulletin/2026/2026-03-01 · Vendor Advisory
• https://source.android.com/security/bulletin/2026-03-01 · Note
• https://reddit.com/r/GalaxyS21/comments/1qqh2tt/s21_firmware_security_update_downloaded_in_usa · Reddit Post