CVE-2025-48523 Overview
CVE-2025-48523 is a local privilege escalation vulnerability in the Android Contacts application. The flaw resides in the onCreate method of SelectAccountActivity.java, where a logic error allows contacts to be added without the required permission. An attacker with local access can exploit the issue without user interaction and without additional execution privileges. Google addressed the vulnerability in the September 2025 Android Security Bulletin. The issue is classified under [CWE-863: Incorrect Authorization] and affects multiple Android versions from 13 through 16.
Critical Impact
A local application can bypass permission checks in SelectAccountActivity to add contacts to a user's device, escalating privileges without any user interaction.
Affected Products
- Google Android 13.0
- Google Android 14.0
- Google Android 15.0 and 16.0
Discovery Timeline
- 2025-09-01 - Google releases fix in the September 2025 Android Security Bulletin
- 2025-09-04 - CVE-2025-48523 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48523
Vulnerability Analysis
The vulnerability exists in SelectAccountActivity.java, a component of the Android Contacts application (packages/apps/Contacts). The onCreate method contains a logic error that fails to enforce the correct permission checks before processing account and contact data. As a result, an unprivileged local application can trigger the activity and cause contacts to be written to the device account without holding WRITE_CONTACTS or comparable permissions.
Because the flaw sits in an exported or reachable activity path, exploitation does not require user interaction. The attacker simply needs to execute code locally, typically via an installed application. The issue maps to [CWE-863: Incorrect Authorization], reflecting a broken authorization decision rather than a missing check.
Root Cause
The root cause is a logic error in onCreate that allows the activity to proceed with contact modification operations without validating the caller's permissions. The authorization decision is present in the code path but implemented incorrectly, permitting execution flows that should be rejected.
Attack Vector
Exploitation requires local access with low privileges. A malicious application installed on the device can invoke SelectAccountActivity through an Intent and cause contact records to be added. Because the exploit runs locally without user interaction, malware that gains a foothold on the device can silently manipulate the contacts store. Refer to the Android Contacts Code Update for the corrected authorization logic.
Detection Methods for CVE-2025-48523
Indicators of Compromise
- Unexpected contact entries added to the device account without user action or explicit granting of WRITE_CONTACTS permission.
- Applications invoking com.android.contacts.activities.SelectAccountActivity via Intent without holding contact-related permissions.
- Anomalous writes to the ContactsContract provider originating from third-party packages.
Detection Strategies
- Audit installed applications for Intent invocations targeting SelectAccountActivity and correlate against declared permissions in each app's manifest.
- Monitor logcat and mobile telemetry for account selection activity launched by non-system UIDs.
- Review Mobile Device Management (MDM) reports for Android build fingerprints predating the September 2025 patch level.
Monitoring Recommendations
- Track the ro.build.version.security_patch property across the fleet and alert on devices below 2025-09-01.
- Use mobile threat defense telemetry to flag applications that write to ContactsContract without holding declared contact permissions.
- Baseline contact write operations per user and alert on statistically abnormal spikes.
How to Mitigate CVE-2025-48523
Immediate Actions Required
- Apply the September 2025 Android security patch level (2025-09-01) or later on all affected devices.
- Instruct users to install available OTA updates from their device vendor immediately.
- Restrict installation of untrusted third-party applications via MDM policy until patches are deployed.
Patch Information
Google published the fix in the Android Security Bulletin September 2025. The corresponding code change is available in the Android Contacts Code Update, which corrects the authorization logic in SelectAccountActivity.onCreate. Device manufacturers deliver the fix as part of their monthly security patch rollout.
Workarounds
- No official workaround exists; upgrading to security patch level 2025-09-01 or later is the only supported remediation.
- Limit sideloading and enforce Google Play Protect on managed devices to reduce the likelihood of a malicious local app.
- Use MDM configuration to block installation of applications from unknown sources on unpatched devices.
# Verify Android security patch level on a device
adb shell getprop ro.build.version.security_patch
# Expected output should be 2025-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
