CVE-2025-48572: Android Framework permissions bypass enables background activity launch

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is a locally exploitable privilege escalation with high CIA impact and is listed in CISA KEV as exploited, though EPSS is low and no ransomware use is documented.

What it is

Multiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentication for a critical function (CWE-306). A local attacker can use this to escalate privileges without any additional execution privileges, and no user interaction is required.

Impact

An attacker gains local privilege escalation, with high impact to confidentiality, integrity and availability per the CVSS vector. The bypass lets code act outside its intended permission boundaries on the device.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so an attacker needs code already running on the device with limited privileges. It is not remotely reachable and does not depend on tricking a user.

Exploitation

CVE-2025-48572 is listed in CISA KEV with a due date of 2025-12-23, indicating known exploitation, though the EPSS 30-day probability is low at 0.00259 (17.8th percentile) and no ransomware campaign use is documented.

What to do

• Apply the Android security bulletin 2025-12-01 update or the vendor patch referenced in the AOSP commit as soon as it is available for your device.
• Follow CISA BOD 22-01 required actions and the KEV due date of 2025-12-23; if no patch exists for a device, discontinue its use.
• Restrict installation and execution of untrusted apps and limit local code execution paths on affected devices.
• Track device models and Android builds that remain unpatched and prioritize them for replacement or isolation.

Detection

• Monitor for unexpected background activity launches and permission-bypass behavior in Android framework logs.
• Alert on privilege escalation attempts or anomalous activity starts originating from low-privileged apps.
• Inventory devices against the December 2025 Android security bulletin patch level and flag unpatched units.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.