CVE-2025-48558 Overview
CVE-2025-48558 is a local privilege escalation vulnerability in the Android BatteryService.java component. The flaw allows a malicious application to hijack implicit intents that the system app dispatches to other components. Because the intents lack explicit targeting, an attacker-controlled app can register to receive them and gain access to data or actions intended for privileged system components. Exploitation requires no user interaction and no additional execution privileges beyond those of an installed local app. The issue affects Android versions 13, 14, 15, and 16, and Google addressed it in the Android Security Bulletin September 2025.
Critical Impact
A local malicious application can escalate privileges to those of a system app by intercepting implicit intents sent by BatteryService, without user interaction.
Affected Products
- Google Android 13.0
- Google Android 14.0
- Google Android 15.0 and Android 16.0
Discovery Timeline
- 2025-09-01 - Google publishes fix in the Android Security Bulletin
- 2025-09-04 - CVE-2025-48558 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48558
Vulnerability Analysis
The vulnerability resides in multiple functions within BatteryService.java, part of the Android platform framework. BatteryService broadcasts intents that describe battery state changes and related events to other system components. Several of these intents are constructed as implicit intents, meaning they specify an action string but do not name a target package or component. Android's intent-resolution logic delivers such broadcasts to any application that has declared a matching intent filter. This behavior maps to [CWE-927: Use of Implicit Intent for Sensitive Communication].
Root Cause
The root cause is the construction and dispatch of implicit intents from a privileged system service to components that should be reached through explicit targeting. When BatteryService sends an implicit intent, the Android runtime resolves recipients based on registered intent filters rather than a fixed package name. A local application that registers a receiver for the same action can therefore intercept the broadcast, read its extras, or interact with the sender.
Attack Vector
An attacker must first install a low-privilege application on the target device. The application declares a <receiver> or <activity> in its manifest with an intent filter that matches the action string broadcast by BatteryService. When the system service dispatches the implicit intent, Android delivers it to the attacker's component. The attacker can then act on data that was intended for a system app, or supply crafted responses that the system service treats as authoritative. Because the attack runs entirely on the local device and requires no user interaction, standard app-installation channels are sufficient for delivery.
No public proof-of-concept has been released, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-48558
Indicators of Compromise
- Installed applications that declare intent filters matching internal Android battery or power broadcast actions without a legitimate business reason.
- Applications requesting broad receiver registration for system-level action strings shortly after installation.
- Unexpected components resolving as candidates for battery-related implicit intents in dumpsys package output.
Detection Strategies
- Perform static analysis of installed APKs and their AndroidManifest.xml files to flag receivers filtering on Android system action strings.
- Monitor mobile device management (MDM) telemetry for sideloaded or newly installed apps on devices that have not applied the September 2025 patch level.
- Correlate application behavior with the Android security patch level reported by the device to prioritize unpatched fleets.
Monitoring Recommendations
- Track the ro.build.version.security_patch property across managed devices and alert on values earlier than 2025-09-01.
- Review mobile threat defense alerts for applications that register receivers for privileged broadcasts.
- Audit enterprise app catalogs for third-party libraries that hook battery or power intents.
How to Mitigate CVE-2025-48558
Immediate Actions Required
- Apply the September 2025 Android security patch level (2025-09-01) or later on all Android 13, 14, 15, and 16 devices.
- Restrict app installation to vetted sources through MDM policy and disable installation from unknown sources.
- Remove untrusted applications that declare receivers for Android system broadcast actions.
Patch Information
Google published the fix in the Android Security Bulletin September 2025. The framework change in AOSP commit 0d30c78c8953 updates BatteryService to use explicit intent targeting or otherwise constrain delivery to trusted system components. Device vendors integrate the patch into their monthly Android security update; end users should install the latest OTA update from their device manufacturer.
Workarounds
- Enforce MDM policy that prohibits sideloading and blocks apps with suspicious manifest declarations until patches are deployed.
- Limit device users to Google Play Protect-verified applications and enable Play Protect scanning.
- Where feasible, isolate sensitive work profiles from personal profiles to reduce exposure of privileged intents to third-party applications.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
