CVE-2025-48572
Android Framework Privilege Escalation Vulnerability
Description
CVE-2025-48572 is a high-severity privilege escalation vulnerability in the Android Framework that enables background activity launching through a permissions bypass. Affecting Android versions 13.0, 14.0, 15.0, and 16.0, the vulnerability exists in multiple locations within the Framework code and allows a local attacker to launch activities from the background without requiring additional execution privileges or user interaction. With a CVSS v3.1 base score of 7.8 and high impact across confidentiality, integrity, and availability, this vulnerability effectively circumvents Android's background activity launch restrictions. CISA has added CVE-2025-48572 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 23, 2025, and the EPSS score of 0.288% at the 51.9th percentile reflects confirmed targeted exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | 13.0; 14.0; 15.0; 16.0 |
References
- https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192(Product)
- https://source.android.com/security/bulletin/2025-12-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48572(Third Party Advisory, US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2025-48572 is classified under CWE-306 (Missing Authentication for Critical Function), which occurs when an application does not perform authentication for functionality that requires a verified identity or authorization check. In the Android Framework, the ability to launch activities from the background is a restricted capability intended to prevent malicious applications from overlaying screens, intercepting user input, or disrupting the user experience. The vulnerability exists because the permission checks that should prevent background activity launches are missing or can be bypassed at multiple code locations, allowing unauthorized applications to invoke activities that should be restricted. This missing authentication for the critical function of activity launching enables a range of attack scenarios from phishing overlays to privilege escalation. Learn more about CWE-306
Impact Analysis
CVE-2025-48572 delivers high impact across all three CIA triad dimensions. Confidentiality is highly impacted because background activity launching enables an attacker to display overlay screens that mimic legitimate applications, intercept user credentials, capture sensitive input, and access data through activities that the user would not normally authorize. Phishing overlays presented from the background are particularly effective because users trust the visual context of their mobile device.
Integrity faces high impact as the attacker can launch activities that modify device settings, grant permissions to malicious applications, or initiate actions that appear to come from the user. The ability to present arbitrary activities from the background means the attacker can simulate user consent for dangerous operations.
Availability is also rated as highly impacted because aggressive background activity launching can disrupt normal device operation, repeatedly interrupt the user, prevent access to legitimate applications, and create denial-of-service conditions on the device. The local attack vector (AV:L) requires the attacker to have a malicious application installed on the device, but the low privilege requirement (PR:L) means no special permissions are needed beyond basic application installation. The EPSS score of 0.288% at the 51.9th percentile combined with CISA KEV inclusion confirms that this vulnerability is being actively exploited in targeted campaigns. The ransomware association is classified as unknown.
Exploit Maturity
CVE-2025-48572 has confirmed active exploitation as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.288% at the 51.9th percentile indicates moderate exploitation probability, consistent with a local attack vector that requires a malicious application already present on the device.
Google has addressed the vulnerability in the Android Security Bulletin for December 2025, with a specific AOSP commit providing the fix. The ransomware association is classified as unknown. Background activity launching bypasses are valuable in the mobile threat landscape because they enable overlay attacks, a technique widely used by banking trojans and credential-stealing malware. The fact that the vulnerability exists in multiple code locations suggests a systemic weakness in the permission enforcement mechanism rather than a single oversight, which may have been discovered and exploited by sophisticated mobile malware families.
Remediation
-
Deploy the December 2025 Android security update as specified in the Android Security Bulletin. This update patches the permissions bypass in multiple Framework locations that allowed background activity launching. Prioritize update deployment across all managed devices running Android 13.0 through 16.0.
-
Enable Google Play Protect on all devices and ensure it remains active. Play Protect provides runtime detection of applications that attempt to exploit background activity launching, which can serve as a compensating control while devices await the security update.
-
Restrict application installation sources to the Google Play Store and approved enterprise app stores. Since exploitation requires a malicious application on the device, preventing sideloading of applications from unknown sources significantly reduces the attack surface.
-
Monitor for overlay attack indicators including unexpected permission prompts, unfamiliar screens appearing over legitimate applications, and reports from users about unusual application behavior. Enterprise MDM solutions can detect applications requesting overlay permissions or exhibiting suspicious activity patterns.
-
Review installed applications across the device fleet for any recently installed or updated applications that do not belong to the approved application catalog. Malicious applications exploiting this vulnerability may have been installed through social engineering, drive-by downloads, or compromised app distribution channels.
Technical Details
CVE-2025-48572 is a permissions bypass vulnerability in the Android Framework. The CVSS v3.1 vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, producing a base score of 7.8.
The vector breakdown reveals a local privilege escalation pattern with comprehensive impact. Attack Vector (AV:L) requires local access through a malicious application. Attack Complexity (AC:L) indicates reliable exploitation without special conditions. Privileges Required (PR:L) means a normal unprivileged application can trigger the vulnerability. User Interaction (UI:N) confirms the attack executes without victim participation. Scope (S:U) indicates impact is contained to the vulnerable component. All three impact metrics, Confidentiality (C:H), Integrity (I:H), and Availability (A:H), are rated high, reflecting the comprehensive control an attacker gains through unrestricted background activity launching.
Android restricts background activity launches starting from Android 10 to prevent malicious applications from displaying overlays, intercepting user input, or disrupting the foreground application. The vulnerability exists in multiple locations within the Framework code where the permission checks enforcing these restrictions can be bypassed. The description indicates a systemic issue rather than a single code path, suggesting that the enforcement mechanism had multiple entry points that were not consistently protected. The AOSP fix addresses these multiple locations to ensure consistent enforcement of background activity launch restrictions across all code paths.
Frequently Asked Questions
What is CVE-2025-48572?
CVE-2025-48572 is a privilege escalation vulnerability in the Android Framework that allows malicious applications to launch activities from the background by bypassing Android's permission restrictions. This enables overlay attacks, credential theft, and other malicious actions without user awareness.
What are background activity launch restrictions?
Starting with Android 10, the operating system restricts applications running in the background from launching visible activities (screens) in the foreground. This prevents malicious apps from suddenly displaying overlays, phishing screens, or disruptive content while the user is using another application.
Which Android versions are affected by CVE-2025-48572?
Android versions 13.0, 14.0, 15.0, and 16.0 are all affected. The fix is included in the December 2025 Android security patch level.
How could an attacker exploit this vulnerability?
An attacker would need a malicious application installed on the target device. The app could then launch activities from the background to display phishing overlays mimicking banking or authentication screens, intercept user input, grant itself additional permissions, or disrupt normal device operation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.