CVE-2025-48591

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48591

CVE-2025-48591 is an Android framework information-disclosure vulnerability caused by a missing permission check in multiple locations, allowing local read-access to another user’s files without requiring privileges or user interaction. Affected: Android devices with patches that address ASB 2025...

CVE-2025-48590

In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is...

CVE-2025-48589

CVE-2025-48589 affects Google Android components, with the vulnerability located in multiple functions of HeaderPrivacyIconsController.kt. The underlying issue is a logic error that can grant permissions across users, enabling local elevation of privilege without extra execution privileges and wi...

CVE-2025-48588

Technical details about CVE-2025-48588 are not publicly provided in the supplied documents. Monitor for updates from Android and vendor advisories to obtain affected products, root cause specifics, impact, and fixes.

EUVD-2025-201771

In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48583

In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48580

In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

EUVD-2025-201772

In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-48576

CVE-2025-48576 affects Android’s framework component NotificationManagerService.java, specifically the function updateNotificationChannelGroupFromPrivilegedListener. The issue is a possible permanent denial of service caused by resource exhaustion, leading to local DoS with no additional executio...

CVE-2025-48575

In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48575

In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48575

Technical details (affected product, versions, root cause, fix) are not publicly provided in the supplied documents. Monitor updates from Android security bulletins and vendor advisories for concrete remediation guidance.

CVE-2025-48573

In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use abuse. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

EUVD-2025-201775

In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use abuse. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-48572

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48572

CVE-2025-48572 is an Android Framework privilege-escalation vulnerability. It stems from improper input validation in the Framework component, allowing a local application to launch activities from background and execute arbitrary code with elevated privileges. Affected products are Android devic...

CVE-2025-48572

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48566

In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48565

The CVE-2025-48565 entry describes a logic error in Android’s cross-profile intent filtering, enabling local escalation of privilege without extra execution privileges or user interaction. Affected component is the Framework/IntentResolver logic in multiple Android locations, with exploitation de...