CVE-2025-48549 Overview
CVE-2025-48549 is a missing authorization vulnerability [CWE-862] affecting Google Android versions 13, 14, and 15. The flaw resides in multiple locations within the Android media framework where a permission check is absent. A background application can exploit this gap to record audio without holding the required permission. Google addressed the issue in the September 2025 Android Security Bulletin.
The vulnerability enables local privilege escalation without additional execution privileges and requires no user interaction. Because audio capture normally requires the RECORD_AUDIO runtime permission, bypassing this control undermines a core Android privacy boundary.
Critical Impact
A background app on affected Android devices can silently record audio, exposing conversations and sensitive audio content without the user's knowledge or consent.
Affected Products
- Google Android 13
- Google Android 14
- Google Android 15
Discovery Timeline
- 2025-09-01 - Google publishes fix in the Android Security Bulletin for September 2025
- 2025-09-04 - CVE-2025-48549 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48549
Vulnerability Analysis
The vulnerability stems from a missing permission check in multiple locations across the Android media stack. Patches were committed to both frameworks/av (native audio framework) and frameworks/base (Java system services), indicating that the enforcement gap spanned several code paths responsible for mediating access to the audio input.
Android's audio subsystem is designed to require the RECORD_AUDIO dangerous permission and, since Android 10, additional foreground-service restrictions preventing background apps from accessing the microphone. When a permission check is omitted along one of these code paths, an app running in the background can obtain an audio stream that would otherwise be blocked by the runtime permission model.
Exploitation results in a confidentiality, integrity, and availability impact on the affected component because the attacker gains a capability the platform reserves for privileged or explicitly authorized apps. No user interaction is required, meaning a malicious app already installed on the device can trigger the condition silently.
Root Cause
The root cause is a missing authorization check [CWE-862] in the audio capture code path. The fixes in platform/frameworks/av (commits 37e7f808 and 8c09eb10) and platform/frameworks/base (commits 00344da6, 20e363e2, and acbd37d2) add the enforcement that was previously absent, ensuring the caller's permission state and foreground status are validated before audio recording proceeds.
Attack Vector
A locally installed application with low privileges initiates an audio capture request while operating in the background. Because the platform fails to verify the required permission along the affected code path, the request succeeds and returns live audio data. The attack does not require exploitation primitives such as memory corruption; it relies solely on invoking the vulnerable API from an unprivileged, untrusted app context.
No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-48549
Indicators of Compromise
- Applications recording audio while not holding a granted RECORD_AUDIO permission in their manifest or runtime grants.
- Audio focus or AudioRecord activity attributed to processes that are not in the foreground and do not run a microphone foreground service.
- Unexpected MediaRecorder or AudioRecord native allocations originating from third-party apps on Android 13, 14, or 15 builds predating the September 2025 patch level.
Detection Strategies
- Compare device ro.build.version.security_patch against 2025-09-01 or later to identify unpatched fleet devices.
- Audit installed apps against the AppOpsManagerOP_RECORD_AUDIO history to identify recordings tied to background processes.
- Use Mobile Threat Defense telemetry to flag apps invoking audio APIs without the corresponding permission declaration.
Monitoring Recommendations
- Enroll Android devices in an enterprise mobility management (EMM) platform that reports security patch level and blocks devices below the September 2025 baseline.
- Monitor for anomalous microphone LED or status-bar indicator activity on devices in sensitive environments.
- Review sideloaded and unknown-source application installations, since exploitation requires a locally installed app.
How to Mitigate CVE-2025-48549
Immediate Actions Required
- Apply the September 2025 Android security patch (2025-09-01 security patch level or later) to all Android 13, 14, and 15 devices.
- Restrict installation of applications from unknown sources on managed devices through EMM policy.
- Remove any applications from the fleet that request RECORD_AUDIO without a documented business justification.
Patch Information
Google released fixes in the Android Security Bulletin September 2025. The corrective changes are landed in the AOSP tree across the following commits: frameworks/av 37e7f808, frameworks/av 8c09eb10, frameworks/base 00344da6, frameworks/base 20e363e2, and frameworks/base acbd37d2. Device OEMs must integrate these patches into their vendor builds and distribute updates to end users.
Workarounds
- Use the system privacy dashboard to review microphone access history and revoke RECORD_AUDIO permission from any application that does not require it.
- Enable the global microphone toggle in Quick Settings on Android 12 and later when the microphone is not needed.
- Enforce work-profile separation for corporate data to limit the reach of a compromised personal-profile app.
# Verify the security patch level on an Android device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for a remediated device: 2025-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
