Vulnerabilities

CVSS

5.5 Medium

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Risk score

100.0

Known exploited

CISA KEV

Published

2025-12-08

Status

Published

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Weaknesses

Information disclosureCWE-noinfo Not enough information

Coverage 1

vulnerability

Google fixes one actively exploited Android zero-day, 124 flaws

Google has released a significant security update addressing 124 vulnerabilities in Android, including a previously exploited zero-day vulnerability (CVE-2025-48595). This update focuses on mitigating targeted attacks an…

BleepingComputer · Jun 2, 2026 High

CVE-2025-48595CVE-2025-48633CVE-2025-48572zero-dayandroidvulnerability

All articles mentioning it

Advisories and references

• android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf27...
• source.android.com/security/bulletin/2025-12-01
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...