Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-48572

CVE-2025-48572HIGH

Google Android — Android Framework

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0026   16.1   YES

AFFECTED
  Product  Versions  Fixed
  Android  16 –      —

TIMELINE
  May 22  Reserved by google_android
  Dec 2   Added to CISA KEV, remediation due 2025-12-23
  Dec 8   Published (CNA: google_android)

CWE-306 · CNA: google_android · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due December 23, 2025

Description

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 22, 2025	Reserved	Reserved by google_android
December 2, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-12-23
December 8, 2025	Published	Published (CNA: google_android)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Google	Android	—	16	—

Weaknesses

CWE-306

References (3)

https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192 [Product]
https://source.android.com/security/bulletin/2025-12-01 [Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48572 [Third Party Advisory, US Government Resource]

Authoritative record: CVE-2025-48572 at cve.org

Vendors: google

Weaknesses: CWE-306

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-48572 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.