CVE-2025-48526 in Android

Riassunto

di MITRE • 04/09/2025

In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Responsabile: Google Android
• Prenotare: 22/05/2025
• Divulgazione: 04/09/2025
• Moderazione: accettato
• Voce: VDB-322700
• CPE: pronto
• CWE: CWE-266 (confermato)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00086
• KEV: no
• Attività: molto basso
• Settore: Police, Homeoffice, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-48526
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-48526
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-48526/