CVE-2025-48574: High severity Google Android vulnerability
In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is locally exploitable and requires no privileges or user interaction. A malicious app could exploit the missing permission check to intercept drag-and-drop events and escalate privileges.
What is the potential impact of successful exploitation?
Successful exploitation could allow an app to intercept drag-and-drop events and achieve escalation of privilege. The supplied CVSS vector indicates high impacts to confidentiality, integrity, and availability.
How can I determine whether this issue applies to my Android environment?
The issue is identified in Google Android, specifically in validateAddingWindowLw of DisplayPolicy.java. Consult the referenced Android security bulletin for affected-product and remediation details.