CVE-2025-48634: High severity Google Android vulnerability
In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
Exploitation requires local access to the affected Android device. No additional execution privileges or user interaction are required.
What is the likely impact if exploitation succeeds?
A successful exploit could allow local escalation of privilege and enable a tapjacking attack. The CVSS vector indicates impacts to confidentiality and availability are low, while integrity impact is high.
Does the available information identify affected Android versions or a workaround?
No. The provided data identifies Google Android but does not specify affected versions, fixed versions, configuration conditions, or mitigation steps if patching cannot be applied immediately.