CVE-2025-48536: High severity Google Android vulnerability
In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48536?
CVE-2025-48536 is classified as a local escalation of privilege vulnerability.
How do I fix CVE-2025-48536?
To fix CVE-2025-48536, it is recommended to update to the latest version of the affected Android software that addresses this issue.
What type of vulnerability is CVE-2025-48536?
CVE-2025-48536 is a security vulnerability that allows a third-party app to modify secure settings due to a confused deputy.
Who is affected by CVE-2025-48536?
Users of Google Android devices that have not been updated to the patch addressing this vulnerability are affected by CVE-2025-48536.
Is user interaction required to exploit CVE-2025-48536?
No, user interaction is not required to exploit CVE-2025-48536.