CVE-2025-48573
BaseFortify
Publication date: 2025-12-08
Last updated on: 2025-12-10
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | android | 3.1 |
| android | 13.0 | |
| android | 14.0 | |
| android | 15.0 | |
| android | 16.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the sendCommand function of MediaSessionRecord.java, where it is possible to launch a foreground service while the app is in the background by abusing the foreground service while-in-use (FGS) mechanism. This can be exploited without user interaction and does not require additional execution privileges.
How can this vulnerability impact me? :
The vulnerability can lead to a local escalation of privilege, meaning an attacker could gain higher privileges on the device without needing extra execution rights or user interaction, potentially allowing unauthorized actions within the app or system.