KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-48633
5.5
KEV
Active Exploitation
Details
VulnerabilityAndroid Framework Information Disclosure Vulnerability
VendorAndroid
ProductFramework
Date added2025-12-02
Due date2025-12-23
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-863
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Descriptions
KEV: Android Framework contains an unspecified vulnerability that allows for information disclosure.
NVD: In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Compliance SSVC + BOD 26-04
Automatableno
Technical impactpartial
Exploitation statusactive
3-day qualifyingNo
Public timeline14 days
Non-public timeline14 days
Forensic (public)Not required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-29 16:44 UTC
Searches4
Component defaultyes
Sources
https://source.android.com/docs/security/bulletin/2025-12-01
https://nvd.nist.gov/vuln/detail/CVE-2025-48633
https://www.helpnetsecurity.com/2025/12/02/android-cve-2025-48633-cve-2025-48572/
https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93
https://github.com/advisories/GHSA-2jv4-596w-g9hj
https://www.sentinelone.com/vulnerability-database/cve-2025-48633/
https://cyberscoop.com/android-security-update-december-2025/
https://nvd.nist.gov/vuln/detail/CVE-2025-48633
https://www.helpnetsecurity.com/2025/12/02/android-cve-2025-48633-cve-2025-48572/
https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93
https://github.com/advisories/GHSA-2jv4-596w-g9hj
https://www.sentinelone.com/vulnerability-database/cve-2025-48633/
https://cyberscoop.com/android-security-update-december-2025/
QC notes
info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)
Hunting hypothesis agent
Hunt logcat for DevicePolicyManagerService setDeviceOwner calls on provisioned devices — the hasAccountsOnAnyUser logic error skips visibility-filtered accounts, allowing unauthorized Device Owner escalation.
Research details
ComponentDevicePolicyManagerService.hasAccountsOnAnyUser() — logic error in account visibility check allows bypass of post-provisioning Device Owner restriction
PreconditionsLocal app installation on Android 13, 14, 15, or 16 via sideloading, phishing, or supply chain compromise; the device must be in a provisioned state (initial setup complete); the malicious app must call DevicePolicyManager.setDeviceOwner() or equivalent provisioning API; at least one user profile must have accounts that are hidden from the calling app's profile due to account visibility restrictions; no additional permissions beyond basic app installation are required; user interaction is not needed for exploitation. agent
DeliveryA malicious app is installed on the target device (via sideloading, phishing, or supply chain compromise). The app calls DevicePolicyManager.setDeviceOwner() to register itself as the Device Owner. The hasAccountsOnAnyUser() check returns false because the app's profile cannot see accounts on other profiles due to visibility restrictions. This allows the Device Owner to be established on an already-provisioned device, granting the app full administrative control including data wipe, policy enforcement, and app installation capabilities.
Public PoCno
Exploit notesCVSS attack complexity: LOW | Medium severity (CVSS 5.5) — exploitation requires only that a malicious app be installed on the target device and call the DevicePolicyManager API to set itself as Device Owner. The hasAccountsOnAnyUser() check is bypassed because the app's profile cannot see accounts on other profiles due to visibility restrictions. Once Device Owner is established, the app gains full administrative control. Google confirmed limited, targeted exploitation in the wild, suggesting state-sponsored actors used this in combination with other vulnerabilities. No public proof-of-concept code exists; the vulnerability was discovered internally by Google. The fix (AOSP commit d00bcda9f42dcf272d329e9bf9298f32af732f93) changes the method to enumerate all accounts regardless of visibility settings. The Android Security Bulletin classifies this as Information Disclosure (ID), but the NVD description and real-world impact indicate privilege escalation.
SummaryCVE-2025-48633 is a logic error in the Android Framework's DevicePolicyManagerService that allows a local malicious app to establish Device Owner privileges on a provisioned device. The flaw resides in the hasAccountsOnAnyUser() method, which checks whether any user accounts exist across all profiles before permitting Device Owner enrollment. Due to account visibility restrictions, the method fails to count accounts on other user profiles, returning a false negative. This allows the app to bypass the post-provisioning Device Owner restriction and gain full administrative control, including the ability to wipe data, set policies, and install apps. Google confirmed limited, targeted exploitation in the wild. Fixed in the December 2025 Android Security Bulletin (patch level 2025-12-01).
Tia coverage
First reported2026-06-02
First exploit report2026-06-02
Exploit report → KEV182 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
android-zero-day-cve-2025-48595-actively-exploited-google-s-june
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.