In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Configurations
Configuration 1 (hide)
|
History
10 Dec 2025, 13:22
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://android.googlesource.com/platform/frameworks/base/+/0f3e248787d88154c8592f6e055b6b3586f4877d - Product, Patch | |
| References | () https://android.googlesource.com/platform/frameworks/base/+/28579dff4305f764302d85f95509671eafbf62ac - Product, Patch | |
| References | () https://android.googlesource.com/platform/packages/modules/IntentResolver/+/4e6cf5285d0b1725fb9141e810050cfdb3fb42fd - Product, Patch | |
| References | () https://source.android.com/security/bulletin/2025-12-01 - Vendor Advisory | |
| CPE | cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:* |
|
| First Time |
Google android
|
08 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
08 Dec 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-08 17:16
Updated : 2025-12-10 13:22
NVD link : CVE-2025-48566
Mitre link : CVE-2025-48566
CVE.ORG link : CVE-2025-48566
JSON object : View
Products Affected
- android
CWE
CWE-20
Improper Input Validation