CVE-2025-48574 Overview
CVE-2025-48574 is a local privilege escalation vulnerability in Google Android. The flaw resides in the validateAddingWindowLw method of DisplayPolicy.java within the Android window management framework. A missing permission check allows a malicious application to intercept drag-and-drop events handled by the system. The issue affects Android versions 14, 15, and 16. Exploitation requires no user interaction and no additional execution privileges. Google addressed the flaw in the Android Security Bulletin March 2026.
Critical Impact
A local application can intercept drag-and-drop events containing sensitive data and escalate privileges without user interaction.
Affected Products
- Google Android 14.0
- Google Android 15.0
- Google Android 16.0
Discovery Timeline
- 2026-03-01 - Google releases security patch in the March 2026 Android Security Bulletin
- 2026-03-02 - CVE-2025-48574 published to NVD
- 2026-03-06 - Last updated in NVD database
Technical Details for CVE-2025-48574
Vulnerability Analysis
The vulnerability falls under [CWE-862]: Missing Authorization. The validateAddingWindowLw function in DisplayPolicy.java is responsible for validating window addition requests within the Android window manager. The function fails to enforce a permission check when an application registers a window that can receive drag-and-drop events. A malicious application can exploit this gap to register itself as a recipient of drag-and-drop operations that should be restricted to privileged components.
Because the validation logic does not verify caller permissions, the attacker app gains access to data payloads transferred during drag-and-drop gestures. These payloads may contain text, URIs, or content provider references belonging to higher-privileged applications. The result is a local elevation of privilege within the Android sandbox model.
Root Cause
The root cause is the absence of an authorization check in validateAddingWindowLw. Android relies on this function to gate the creation of windows that participate in system-level interactions. Without the check, the window manager accepts requests from any installed application, regardless of its declared permissions or signature level.
Attack Vector
The attack requires local access through an installed application. The malicious app registers an invisible or overlay window that the window manager treats as a legitimate drag-and-drop target. When the user or another application initiates a drag operation, the attacker receives the dispatched events and their associated ClipData. No user interaction or additional permissions are required to trigger exploitation.
No public proof-of-concept code is available. Refer to the Android Security Bulletin March 2026 for vendor-provided technical details.
Detection Methods for CVE-2025-48574
Indicators of Compromise
- Installed applications that register windows with unusual WindowManager.LayoutParams flags or overlay types without a corresponding user-facing UI.
- Logcat entries from WindowManager showing window additions from non-system packages targeting drag-and-drop event types.
- Unexpected access to ClipData content URIs by third-party packages without READ_URI_PERMISSION grants.
Detection Strategies
- Inspect installed APKs for invocations of addView and WindowManager APIs combined with OnDragListener registrations from non-foreground processes.
- Audit mobile device management (MDM) inventories for Android builds prior to the March 2026 security patch level.
- Use mobile threat defense tooling to flag applications that request overlay permissions and subscribe to system drag events.
Monitoring Recommendations
- Track the ro.build.version.security_patch property across managed devices to confirm patch deployment.
- Forward Android logcat and MDM telemetry to a centralized analytics platform for anomaly review.
- Monitor for new application installations that target system window layers shortly after device provisioning.
How to Mitigate CVE-2025-48574
Immediate Actions Required
- Apply the March 2026 Android security patch level (2026-03-01) or later to all affected devices.
- Enforce MDM policies that block installation of applications from untrusted sources on Android 14, 15, and 16 endpoints.
- Review installed applications and remove any with unjustified overlay or accessibility permissions.
Patch Information
Google released a fix in the March 2026 Android Security Bulletin. Device manufacturers distribute the patch through their respective OTA channels. Verify that managed devices report a security patch level of 2026-03-01 or later. See the Android Security Bulletin March 2026 for build identifiers and source code references.
Workarounds
- Restrict installation of third-party applications until the patch is deployed across the fleet.
- Disable drag-and-drop functionality in enterprise applications that handle sensitive ClipData content where feasible.
- Use work profile separation to limit cross-profile drag-and-drop event exposure on managed Android devices.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-03-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.