Vulnerabilities

CVSS

7.8 High

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2025-12-08

Status

Analyzed

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Weaknesses

CWE-306

Coverage 1

vulnerability

Google fixes one actively exploited Android zero-day, 124 flaws

Google has released a significant security update addressing 124 vulnerabilities in Android, including a previously exploited zero-day vulnerability (CVE-2025-48595). This update focuses on mitigating targeted attacks an…

BleepingComputer · Jun 2, 2026 High

CVE-2025-48595CVE-2025-48633CVE-2025-48572zero-dayandroidvulnerability

All articles mentioning it

Advisories and references

• android.googlesource.com/platform/frameworks/base/+/e707f6600330691f...
• source.android.com/security/bulletin/2025-12-01
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...