CVE-2025-48526
BaseFortify
Publication date: 2025-09-04
Last updated on: 2025-09-05
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 15.0 | |
| android | 16.0 | |
| android | 14.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the createMultiProfilePagerAdapter method of ChooserActivity.java, where improper input validation allows an app to launch the ChooserActivity in another user profile. This can lead to a local escalation of privilege without requiring any additional execution privileges or user interaction.
How can this vulnerability impact me? :
The vulnerability can allow a malicious app to escalate its privileges locally by accessing or interacting with another user profile's ChooserActivity, potentially leading to unauthorized actions or access within the device without needing user interaction or extra permissions.