CVE-2025-48572 Android Framework Privilege Escalation

Exploited in the wild High 7.8 Published 8 Dec 2025 Updated 26 Feb 2026

Local attackers can bypass permissions to launch background activities, leading to privilege escalation without user interaction.

Exploited in the wild: Since 2 Dec 2025
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-48572?

CVE-2025-48572 is a high-severity vulnerability in Google Android, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Weakness: CWE-306

Which versions are affected by CVE-2025-48572?

It affects 1 product.

Products include Google Android.

How do I fix CVE-2025-48572?

Apply the vendor's patch. US federal agencies must fix it by 23 Dec 2025.

Is CVE-2025-48572 being exploited?

Yes. Attackers have exploited CVE-2025-48572 in the wild since at least 2 Dec 2025.

All Google Android vulnerabilities

Sources

Also known as A-385736540, ASB-A-385736540, GHSA-4rw8-q5j6-vc96.