CVE-2025-48582: High severity Google Android vulnerability
In multiple locations, there is a possible way to delete media without the MANAGEEXTERNALSTORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What level of attacker access is required?
An attacker needs local access to the device and does not need prior privileges or user interaction. Successful exploitation can allow deletion of media without the MANAGE_EXTERNAL_STORAGE permission.
What is the potential impact if exploitation succeeds?
The impact is limited to unauthorized deletion of media, but the vulnerability is rated high severity with high confidentiality, integrity, and availability impacts in the provided CVSS vector.
How can I determine whether a device is affected?
The provided information does not identify affected Android versions, device builds, or a detection method. Review the Android security bulletin reference for vendor-specific remediation and applicability details.