CVE-2025-48621
BaseFortify
Publication date: 2025-12-08
Last updated on: 2025-12-08
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | 13.0 | |
| android | 14.0 | |
| android | 15.0 | |
| android | 16.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in DefaultTransitionHandler.java and allows a tapjacking attack due to an insecure default setting. Tapjacking is a technique where a user is tricked into tapping on something different from what they perceive, potentially enabling local escalation of privilege without needing additional execution privileges. Exploitation requires user interaction.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to escalate their privileges locally on your device without needing extra execution privileges. Since it involves tapjacking, it could trick you into performing unintended actions, potentially compromising your device's security.