Permissions Bypass in Android OS Leading to Privilege Escalation

Publication date: 2026-06-01

Last updated on: 2026-06-03

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-01

Last Modified

2026-06-03

Generated

2026-07-12

AI Q&A

2026-06-02

EPSS Evaluated

2026-07-11

NVD

CVE-2025-48649

EUVD

EUVD-2025-210016

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	14.0
google	android	15.0
google	android	16.0
google	android	16.0
google	android	16.0
google	android	16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Impact Analysis

The vulnerability can allow an attacker with local access to escalate their privileges on the affected system. This means they could gain higher-level permissions than intended, potentially compromising system security or accessing restricted data.

Executive Summary

This vulnerability involves a permissions bypass in multiple locations that allows resetting user-selected permission settings. It can lead to a local escalation of privilege without requiring any additional execution privileges or user interaction.

Hi! I’m here to help you understand CVE-2025-48649. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70