CVE-2025-48635

In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://source.android.com/docs/security/bulletin/2026/2026-03-01

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android:14.0:::::::*
	cpe:2.3:o:google:android:15.0:::::::*

History

17 Jun 2026, 09:30

Type	Values Removed	Values Added
Summary		(es) En múltiples funciones de TaskFragmentOrganizerController.java, existe una posible fuga de token de actividad debido a un error de lógica en el código. Esto podría conducir a una escalada local de privilegios sin privilegios de ejecución adicionales necesarios. No se necesita interacción del usuario para la explotación.

06 Mar 2026, 04:15

Type	Values Removed	Values Added
References	~~{'url': 'https://source.android.com/security/bulletin/2026-03-01', 'tags': ['Broken Link'], 'source': 'security@android.com'}~~	() https://source.android.com/docs/security/bulletin/2026/2026-03-01 -

03 Mar 2026, 18:12

Type	Values Removed	Values Added
References	~~() https://source.android.com/security/bulletin/2026-03-01 -~~	() https://source.android.com/security/bulletin/2026-03-01 - Broken Link
CPE		cpe:2.3:o:google:android:14.0:::::::* cpe:2.3:o:google:android:15.0:::::::*
First Time		Google android Google

03 Mar 2026, 17:16

Type	Values Removed	Values Added
CWE		CWE-200 CWE-532 CWE-693
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.7

02 Mar 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-02 19:16

Updated : 2026-06-17 09:30

NVD link : CVE-2025-48635

Mitre link : CVE-2025-48635

CVE.ORG link : CVE-2025-48635

JSON object : View

Products Affected

google

android

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-532

Insertion of Sensitive Information into Log File

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-48635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48635", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-04T04:55:19.035672Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.5}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security@android.com", "affectedData": [{"vendor": "Google", "product": "Android", "versions": [{"status": "affected", "version": "15"}, {"status": "affected", "version": "14"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-02T19:16:27.787", "references": [{"url": "https://source.android.com/docs/security/bulletin/2026/2026-03-01", "source": "security@android.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-532"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}, {"lang": "es", "value": "En m\u00faltiples funciones de TaskFragmentOrganizerController.java, existe una posible fuga de token de actividad debido a un error de l\u00f3gica en el c\u00f3digo. Esto podr\u00eda conducir a una escalada local de privilegios sin privilegios de ejecuci\u00f3n adicionales necesarios. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n."}], "lastModified": "2026-06-17T09:30:08.683", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D"}, {"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}