CVE-2025-48633
Android Framework Information Disclosure Vulnerability
Description
CVE-2025-48633 is a medium-severity privilege escalation vulnerability in the Android Framework component, affecting Android versions 13.0, 14.0, 15.0, and 16.0. The vulnerability exists in the hasAccountsOnAnyUser function of DevicePolicyManagerService.java, where a logic error allows an attacker to add a Device Owner after the device has already been provisioned. With a CVSS v3.1 base score of 5.5, this local attack vector enables escalation to Device Owner privileges without requiring additional execution privileges or user interaction. CISA has added CVE-2025-48633 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 23, 2025, though the EPSS score of 0.183% at the 40th percentile suggests relatively targeted exploitation compared to network-accessible vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | 13.0; 14.0; 15.0; 16.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
No specific CWE has been assigned to CVE-2025-48633 by the NVD. However, the vulnerability is described as a logic error in the code that governs Device Owner provisioning enforcement. This type of flaw falls broadly under authorization bypass weaknesses, where the application fails to properly enforce a security-critical state transition. Specifically, the hasAccountsOnAnyUser method in DevicePolicyManagerService.java contains flawed logic that does not correctly prevent Device Owner assignment after initial device provisioning has completed. The intended security control requires that Device Owner can only be set during the initial setup process, but the logic error creates a window or condition under which this restriction can be circumvented.
Impact Analysis
The impact of CVE-2025-48633 is focused on confidentiality, which receives a high impact rating in the CVSS assessment. A Device Owner in Android has extraordinary control over the device, including the ability to silently install and uninstall applications, access all device data, configure network settings, enforce policies across all user profiles, and monitor all activity on the device. By gaining Device Owner status after provisioning, an attacker effectively gains the highest level of administrative control available on an Android device.
While the CVSS vector rates integrity and availability as not impacted (I:N/A:N), the practical consequences of Device Owner compromise extend far beyond confidentiality. Device Owner access enables installation of surveillance software, configuration of VPN profiles to route traffic through attacker-controlled infrastructure, enforcement of certificate authorities that enable man-in-the-middle attacks, and policy changes that prevent the legitimate user from revoking the unauthorized Device Owner status. The local attack vector (AV:L) and low privilege requirement (PR:L) mean exploitation requires either physical access or a malicious application already running on the device. The EPSS score of 0.183% at the 40th percentile suggests this vulnerability is being exploited in targeted scenarios rather than mass exploitation campaigns, which is consistent with the local access requirement. CISA's inclusion in the KEV catalog despite the relatively low EPSS score indicates confirmed exploitation in high-value targeted attacks.
Exploit Maturity
CVE-2025-48633 has been confirmed as actively exploited, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.183% at the 40th percentile is relatively low compared to network-accessible vulnerabilities, reflecting the local access requirement that limits mass exploitation. However, CISA's KEV inclusion confirms that targeted exploitation is occurring in the wild.
Google has released a patch as part of the Android Security Bulletin for December 2025, with the specific fix available in the AOSP commit. The ransomware association is classified as unknown. The nature of this vulnerability, enabling Device Owner assignment on already-provisioned devices, suggests exploitation by threat actors engaged in mobile device surveillance, corporate espionage, or targeted attacks against specific individuals or organizations where physical or application-level access to the device has been obtained.
Remediation
-
Apply the December 2025 Android security update as documented in the Android Security Bulletin. This update patches the logic error in DevicePolicyManagerService.java that allows unauthorized Device Owner assignment. Ensure all managed Android devices across versions 13.0 through 16.0 receive this update.
-
Verify Device Owner status on all managed Android devices in your fleet. Use enterprise mobility management (EMM) tools to query the Device Owner state and flag any devices that have an unexpected Device Owner configured. Any device with an unauthorized Device Owner should be treated as potentially compromised.
-
Enforce mobile device management policies that restrict installation of applications from unknown sources, as exploitation requires local access or a malicious application running on the device. Ensure that Google Play Protect is enabled and that sideloading of applications is disabled on enterprise-managed devices.
-
Monitor for anomalous device behavior including unexpected policy changes, new certificate authorities, VPN configuration modifications, or silent application installations that could indicate exploitation of Device Owner privileges.
-
Implement device attestation where possible to verify the integrity of the Android security patch level and Device Owner configuration state before granting access to corporate resources.
Technical Details
CVE-2025-48633 is a logic error vulnerability in the Android Framework component DevicePolicyManagerService.java. The CVSS v3.1 vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, producing a base score of 5.5.
The vector analysis reveals a local privilege escalation attack pattern. Attack Vector (AV:L) indicates the attacker must have local access to the device, either physical access or through a malicious application. Attack Complexity (AC:L) means exploitation is straightforward with no special conditions. Privileges Required (PR:L) indicates basic user-level privileges are sufficient. User Interaction (UI:N) confirms the attack can execute without any victim participation. Scope (S:U) means the impact remains within the Android Framework component boundary. Confidentiality (C:H) is rated high because Device Owner access provides read access to all device data, while Integrity (I:N) and Availability (A:N) are rated as not impacted in the CVSS assessment.
The vulnerability resides in the hasAccountsOnAnyUser method within DevicePolicyManagerService.java. Android's security model enforces that a Device Owner can only be established during the initial device provisioning process (factory reset followed by setup). This restriction prevents malicious actors from retroactively taking over a device that is already in use. The logic error in hasAccountsOnAnyUser creates a condition where the check that prevents post-provisioning Device Owner assignment evaluates incorrectly, allowing the setDeviceOwner API to succeed when it should be blocked. The AOSP fix corrects this logic to properly enforce the provisioning state check.
Frequently Asked Questions
What is CVE-2025-48633?
CVE-2025-48633 is a privilege escalation vulnerability in the Android Framework that allows a local attacker to assign Device Owner status to an application after the device has already been provisioned. Device Owner is the highest level of administrative control on an Android device.
Which Android versions are affected?
Android versions 13.0, 14.0, 15.0, and 16.0 are all affected. The fix is included in the December 2025 Android security update.
What can an attacker do with Device Owner access?
A Device Owner can silently install and remove applications, access all data on the device, configure network and VPN settings, enforce security policies, manage certificates, and monitor device activity. It represents complete administrative control over the Android device.
Does exploitation require physical access to the device?
The vulnerability requires local access (AV:L), which means either physical access to the device or a malicious application already running on it. It cannot be exploited remotely over the network, which limits its exploitation to targeted attack scenarios.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.