CVE-2025-48608: Medium severity Google Android vulnerability

Published Dec 8, 2025

Updated

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

1 affected component

Google Android=16.0

Event History

Dec 8, 2025

CVE Published

via MITRE·05:27 PM

Data Sourced

via MITRE·05:27 PM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-48608?

CVE-2025-48608 is classified as a moderate severity vulnerability that could lead to local information disclosure.

How do I fix CVE-2025-48608?

To mitigate CVE-2025-48608, update your Android device to the latest security patch that addresses this vulnerability.

What type of vulnerability is CVE-2025-48608?

CVE-2025-48608 is a cross-user media read vulnerability resulting from a missing permission check in SettingsProvider.java.

Who is affected by CVE-2025-48608?

Users of Google Android version 16.0 are affected by CVE-2025-48608 due to the lack of proper permission checks.

Is user interaction required to exploit CVE-2025-48608?

No, user interaction is not needed for the exploitation of CVE-2025-48608, making it easier to exploit.