CVE-2025-48547: Google Android Privilege Escalation Flaw

CVE-2025-48547 Overview

CVE-2025-48547 is a local privilege escalation vulnerability in the Android Permission module. A logic error in multiple locations allows a one-time permission bypass, granting an application access beyond what the user authorized. Google addressed the flaw in the Android Security Bulletin dated September 1, 2025. The issue affects Android versions 13, 14, 15, and 16 and is categorized under CWE-862: Missing Authorization.

Critical Impact
A local, low-privileged application can escalate privileges by bypassing the one-time permission gate. Exploitation requires user interaction but no additional execution privileges.

Affected Products

Google Android 13
Google Android 14
Google Android 15
Google Android 16

Discovery Timeline

2025-09-04 - CVE-2025-48547 published to the National Vulnerability Database
2025-09-01 - Google publishes the Android Security Bulletin with the fix
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-48547

Vulnerability Analysis

Android's one-time permission model lets a user grant an app access to sensitive resources such as location, microphone, or camera for a single session. The permission is expected to be revoked once the app moves to the background or the session ends. CVE-2025-48547 breaks that expectation. A logic error in the Permission module (packages/modules/Permission) allows the granted access to persist beyond the intended one-time boundary. The result is a privilege state that the user never explicitly authorized. The fix landed in the AOSP Permission module in commit 5dca0ccb26f2b99d706a1d3e9402f851e849c913.

Root Cause

The root cause is a missing authorization check, tracked under CWE-862. The permission state machine fails to correctly re-evaluate the one-time grant across specific code paths. When those paths are triggered, the runtime treats the grant as still valid and skips the revocation step. Because the check is absent rather than incorrect, the bypass is deterministic once the correct sequence is reached.

Attack Vector

Exploitation is local and requires user interaction. A malicious or repackaged app first requests a sensitive permission and prompts the user to select "Only this time." The app then drives the affected UI or lifecycle sequence that triggers the logic error, causing the runtime not to revoke access. From that point, the app can continue to read the sensitive resource without a fresh prompt. The technical patch reference is the Android Permission Module Update.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2025-48547 at the time of writing. See the Android Security Bulletin September 2025 for advisory details.

Detection Methods for CVE-2025-48547

Indicators of Compromise

Applications retaining access to microphone, camera, or location after moving to background following a one-time grant.
Privacy indicator dots or status bar icons appearing when no foreground app should hold the permission.
Unexpected entries in Android Privacy Dashboard showing sensor access outside the granted session window.

Detection Strategies

Audit PermissionController logs on managed devices for one-time grants that are not followed by a revocation event.
Monitor mobile telemetry for applications that access ACCESS_FINE_LOCATION, RECORD_AUDIO, or CAMERA outside of a documented foreground session.
Correlate application lifecycle transitions with permission usage events to identify grants that persist beyond expected bounds.

Monitoring Recommendations

Enroll devices in an MDM or EMM that reports Android security patch level and flags devices below the 2025-09-01 patch level.
Enable Google Play Protect and review its runtime permission alerts.
Track Privacy Dashboard data over time for anomalies in sensor access per application.

How to Mitigate CVE-2025-48547

Immediate Actions Required

Apply the September 2025 Android security patch level (2025-09-01 or later) on all affected Android 13, 14, 15, and 16 devices.
Instruct users to install pending system updates and restart their devices.
Remove or restrict apps from untrusted sources that request sensitive runtime permissions.

Patch Information

Google fixed the issue in the Android Security Bulletin September 2025. The upstream code change is available in the Android Permission Module Update. Original equipment manufacturers ship the fix as part of their monthly security patch level starting 2025-09-01.

Workarounds

Prefer "Don't allow" over "Only this time" for sensitive permissions until the patch is installed.
Manually revoke runtime permissions in Settings → Privacy → Permission manager after using an app that requested sensitive access.
Enforce enterprise policy to disable installation of applications from unknown sources.

bash

# Verify Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-09-01 or later