CVE-2025-48546 Overview
CVE-2025-48546 is a local privilege escalation vulnerability in Google Android affecting the checkPermissions method of SafeActivityOptions.java. A logic error in the permissions check allows a background activity launch that bypasses intended security constraints. An attacker with local access and low privileges can escalate to higher privileges without user interaction. The flaw is categorized under [CWE-693] (Protection Mechanism Failure). Google addressed the issue in the Android Security Bulletin September 2025.
Critical Impact
Local privilege escalation on Android 13, 14, 15, and 16 without user interaction, enabling unauthorized background activity launches.
Affected Products
- Google Android 13.0
- Google Android 14.0
- Google Android 15.0 and 16.0
Discovery Timeline
- 2025-09-04 - CVE-2025-48546 published to NVD
- September 2025 - Google releases patch via Android Security Bulletin September 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48546
Vulnerability Analysis
The vulnerability resides in the checkPermissions method of SafeActivityOptions.java, part of the Android frameworks/base platform code. Android enforces restrictions on background activity launches to prevent apps from displaying arbitrary UI or hijacking the foreground when they should not have that capability. A logic error in the permission validation path allows these restrictions to be circumvented under specific conditions.
The defect maps to [CWE-693] (Protection Mechanism Failure), meaning the protection exists but does not function as designed. A local, low-privileged app can trigger the flawed code path to launch activities that should be denied, gaining execution in a more privileged context. No user interaction is required. Refer to the Android source commit for the fix details.
Root Cause
The root cause is an incorrect conditional in checkPermissions that fails to enforce background activity launch restrictions consistently. When the flawed branch is reached, the caller is treated as authorized to launch background activities without meeting all the required conditions.
Attack Vector
Exploitation requires a locally installed application with low privileges on the target device. The malicious app crafts activity options that reach the vulnerable code path, triggering an unauthorized background activity launch. The result is local escalation of privilege within the Android security model.
No verified public exploit code is available. The vulnerability mechanism is described in prose based on the Android source commit that corrects the permission check.
Detection Methods for CVE-2025-48546
Indicators of Compromise
- Unexpected background activity launches originating from unprivileged third-party applications.
- Apps invoking ActivityOptions APIs in patterns inconsistent with their declared functionality.
- Elevated process behavior following installation of recently sideloaded or untrusted APKs.
Detection Strategies
- Monitor logcat for ActivityTaskManager and ActivityStarter entries showing background launches denied elsewhere but permitted on unpatched builds.
- Inspect installed applications for requests to launch activities across UID boundaries without foreground state.
- Use mobile threat defense tooling to flag apps abusing activity launch APIs on pre-September 2025 Android security patch levels.
Monitoring Recommendations
- Track the Android security patch level (ro.build.version.security_patch) across the mobile fleet and alert on devices below 2025-09-01.
- Correlate app installation events with subsequent privilege-sensitive activity launches in mobile EDR telemetry.
- Review enterprise mobility management (EMM) inventory to identify Android 13 through 16 devices missing the September 2025 patch.
How to Mitigate CVE-2025-48546
Immediate Actions Required
- Apply the September 2025 Android security patch level (2025-09-01 or later) on all Android 13, 14, 15, and 16 devices.
- Prioritize patch deployment for devices that permit sideloading or run untrusted third-party applications.
- Restrict installation sources to Google Play or a managed enterprise app catalog until patching is complete.
Patch Information
Google released the fix in the Android Security Bulletin September 2025. The corresponding code change is available in the Android source commit, which corrects the logic in SafeActivityOptions.checkPermissions. Device manufacturers deliver the fix through vendor OTA updates aligned with the September 2025 patch level.
Workarounds
- Enforce Google Play Protect and block installation from unknown sources through EMM policy.
- Remove or restrict apps that request activity launch or overlay-related capabilities without a clear business justification.
- Where feasible, isolate sensitive workloads on devices already updated to the September 2025 patch level.
# Verify Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output should be 2025-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
