CVE-2025-48533: Race Condition
In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16-next:2025-08-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 15:2025-08-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 16:2025-08-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 13:2025-08-01 - Upgrade
Upgrade
android/platform/frameworks/baseto a version that resolves this vulnerability.Fixed in 14:2025-08-01
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs local access and low-level privileges on the device. Exploitation does not require user interaction or additional execution privileges.
What is the likely impact if exploitation succeeds?
Successful exploitation can result in local escalation of privilege. The CVSS vector indicates potential high impact to confidentiality, integrity, and availability.
What condition is involved in exploitation?
The issue relies on a race condition involving apps linked from a context menu in a lockscreen app. Exploitation requires winning that race condition, reflected in the high attack complexity rating.