CVE-2025-48646: High severity Google Android vulnerability
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access is required and no privileges are required beforehand. Exploitation also requires user interaction.
What is the potential impact if exploitation succeeds?
The issue can allow a local escalation of privilege through a confused-deputy condition in ActivityStarter.java. The reported impact includes high confidentiality, integrity, and availability effects.
How can I determine whether an Android device is affected?
The provided information identifies Google Android but does not specify affected versions, builds, or patch levels. Review the referenced March 1, 2026 Android security bulletin for applicability details.