CVE-2025-48620: High severity Google Android vulnerability
In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48620?
CVE-2025-48620 is classified as a local escalation of privilege vulnerability.
How do I fix CVE-2025-48620?
To mitigate CVE-2025-48620, ensure that your Android device is updated to the latest security patches from Google.
What versions of Android are affected by CVE-2025-48620?
CVE-2025-48620 affects Google Android versions 13.0, 14.0, 15.0, and 16.0.
What are the implications of CVE-2025-48620?
CVE-2025-48620 can allow third-party applications to retain persistent functionality even after being uninstalled, leading to potential unauthorized access.
Is CVE-2025-48620 a known issue in Android?
Yes, CVE-2025-48620 is a documented vulnerability identified in the Android operating system.