CVE-2025-48535

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

PT-2021-13358 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-9 through Android-11 Description: The issue is related to a parcel serialization/deserialization mismatch in the createFromParcel method of OutputConfiguration.java due to improper input validation. This could lead to...