KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-48572
7.8
3-Day Required
KEV
Active Exploitation
Details
VulnerabilityAndroid Framework Privilege Escalation Vulnerability
VendorAndroid
ProductFramework
Date added2025-12-02
Due date2025-12-23
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-306
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Android Framework contains an unspecified vulnerability that allows for privilege escalation.
NVD: In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-29 15:42 UTC
Searches6
Component defaultyes
Sources
https://source.android.com/docs/security/bulletin/2025-12-01
https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192
https://nvd.nist.gov/vuln/detail/CVE-2025-48572
https://www.sentinelone.com/vulnerability-database/cve-2025-48572/
https://www.helpnetsecurity.com/2025/12/02/android-cve-2025-48633-cve-2025-48572/
https://socprime.com/blog/cve-2025-48633-and-cve-2025-48572-vulnerabilities/
https://github.com/advisories/GHSA-4rw8-q5j6-vc96
https://healsecurity.com/top-20-most-exploited-vulnerabilities-of-2025-a-comprehensive-analysis/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48572
https://socradar.io/blog/december-2025-android-security-bulletin/
https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192
https://nvd.nist.gov/vuln/detail/CVE-2025-48572
https://www.sentinelone.com/vulnerability-database/cve-2025-48572/
https://www.helpnetsecurity.com/2025/12/02/android-cve-2025-48633-cve-2025-48572/
https://socprime.com/blog/cve-2025-48633-and-cve-2025-48572-vulnerabilities/
https://github.com/advisories/GHSA-4rw8-q5j6-vc96
https://healsecurity.com/top-20-most-exploited-vulnerabilities-of-2025-a-comprehensive-analysis/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48572
https://socradar.io/blog/december-2025-android-security-bulletin/
QC notes
warn component_extraction: Component 'ActivityTaskManagerService / ActivityManagerService background activity launch (BAL) restriction code paths — multiple locations in Android Frameworks Base where permission checks for background activity starts are missing or bypassable' matches or contains product name 'Framework' — no specific component identified
Hunting hypothesis agent
Hunt ActivityTaskManagerService logs for background activity launches by cached or non-foreground UIDs — the BAL bypass lets a sideloaded app start activities without user interaction on Android 13-16.
Research details
ComponentActivityTaskManagerService / ActivityManagerService background activity launch (BAL) restriction code paths — multiple locations in Android Frameworks Base where permission checks for background activity starts are missing or bypassable
PreconditionsA malicious application must be installed on the target device running Android 13, 14, 15, or 16; the app requires no special permissions beyond standard app install (no overlay, accessibility, or device-admin privileges needed); the vulnerability is triggered entirely in the background with no user interaction required after installation; the attacker app invokes affected framework code paths that bypass BAL restrictions to start activities while the app is not in the foreground; exploitation is local (AV:L) and requires only low-privileges (PR:L) within the app sandbox; the device must not have the December 2025 security patch (patch level 2025-12-01 or later). agent
DeliveryA malicious application is delivered to the target device via sideloading, a third-party app store, or a previously installed app that pivots to this primitive. Once installed, the app invokes affected Android Framework code paths that bypass background activity launch (BAL) restrictions — specifically, missing authorization checks in ActivityTaskManagerService/ActivityManagerService that validate whether a calling process meets the requirements to start an activity in the background. The app launches an activity from a non-foreground state without holding the required permissions or foreground status. The launched activity reaches the foreground, inheriting user-facing trust, and can display spoofed credential prompts, approve runtime permissions, or chain into other elevation primitives. No user interaction is needed beyond the initial app installation. The attack is entirely local and requires no network connectivity.
Public PoCno
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.8) — the vulnerability requires only that a malicious app be installed; no user interaction is needed after installation and no additional execution privileges are required. The permissions bypass exists in multiple code paths within the Android Framework's activity management, specifically the background activity launch (BAL) restriction enforcement. Google confirmed limited, targeted exploitation in the wild, with reporting linking the activity to Chinese nation-state groups. No public exploit code exists as of August 2026; SentinelOne's vulnerability database explicitly notes 'Verified exploit code for CVE-2025-48572 is not public.' The AOSP fix (commit e707f660) adjusts framework logic to close the bypass in BAL validation. Exploitation enables a malicious app to display activities over the user's current task, inheriting user-facing trust to capture credentials via spoofed prompts, approve sensitive runtime permissions, or chain into other elevation primitives.
SummaryCVE-2025-48572 is a permissions bypass vulnerability in the Android Framework's activity management system that allows a locally installed malicious application to launch activities from the background, bypassing the platform's background activity launch (BAL) restrictions. The flaw exists in multiple code paths within ActivityTaskManagerService/ActivityManagerService where permission checks for background activity starts are missing or bypassable (CWE-306). Once an attacker-controlled activity reaches the foreground, the app inherits user-facing trust and can capture credentials through spoofed prompts, approve sensitive runtime permissions, or chain into other elevation primitives. The vulnerability affects Android 13, 14, 15, and 16 and was confirmed under limited, targeted exploitation in the wild — Google attributed the activity to sophisticated threat actors. Google patched the flaw in the December 2025 Android Security Bulletin (patch level 2025-12-01) via AOSP commit e707f660. CISA added CVE-2025-48572 to its Known Exploited Vulnerabilities catalog on December 2, 2025, with a remediation deadline of December 23, 2025.
Tia coverage
First reported2026-06-02
First exploit report2026-06-02
Exploit report → KEV182 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
android-zero-day-cve-2025-48595-actively-exploited-google-s-june
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.