CVE-2025-48629: High severity Google Android vulnerability
Published Dec 1, 2025
·Updated
In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
5 affected components
Google Android
Google Android=13.0
Google Android=14.0
Google Android=15.0
Google Android=16.0
Event History
Dec 1, 2025
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
Affected Software
Dec 8, 2025
CVE Published
via MITRE·04:57 PM
Data Sourced
via MITRE·04:57 PM
DescriptionWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-48629?
CVE-2025-48629 is classified as a local escalation of privilege vulnerability.
2
How do I fix CVE-2025-48629?
To fix CVE-2025-48629, update your Android device to the latest version provided by Google.
3
Which Android versions are affected by CVE-2025-48629?
CVE-2025-48629 affects Android versions 13.0, 14.0, 15.0, and 16.0.
4
What could happen if CVE-2025-48629 is exploited?
Exploitation of CVE-2025-48629 could allow an attacker to become the default speech recognizer app without user interaction.
5
Who is the vendor associated with CVE-2025-48629?
The vendor associated with CVE-2025-48629 is Google.