CVE-2025-48602 Overview
CVE-2025-48602 is a lockscreen bypass vulnerability in Google Android affecting the exitKeyguardAndFinishSurfaceBehindRemoteAnimation method of KeyguardViewMediator.java. A logic error in the keyguard exit code allows local privilege escalation without user interaction. The flaw maps to [CWE-693: Protection Mechanism Failure] and affects Android versions 14, 15, and 16, including multiple QPR2 beta builds. Google addressed the issue in the March 2026 Android Security Bulletin.
Critical Impact
An attacker with local access to a locked device can bypass the lockscreen and gain elevated privileges without user interaction, exposing user data and device functionality.
Affected Products
- Google Android 14.0
- Google Android 15.0
- Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)
Discovery Timeline
- 2026-03-02 - CVE-2025-48602 published to NVD
- 2026-03-06 - Last updated in NVD database
Technical Details for CVE-2025-48602
Vulnerability Analysis
The vulnerability resides in KeyguardViewMediator.java, the system component responsible for managing the Android lockscreen state. The exitKeyguardAndFinishSurfaceBehindRemoteAnimation method coordinates the transition from a locked state to an unlocked surface using remote animations. A logic error in this transition handling allows the keyguard to be dismissed under conditions where it should remain enforced.
Because the flaw lives in the protection mechanism itself, exploitation does not require additional permissions or user interaction. The attack vector is local, meaning the attacker must have physical access to the device or be able to invoke the affected code path through an installed application.
Successful exploitation grants access to the unlocked user session, which Android treats as a trust boundary for access to user data, accounts, and protected APIs. This results in local escalation of privilege from a pre-authentication state to a fully authenticated user context.
Root Cause
The root cause is a logic error in the keyguard exit flow inside KeyguardViewMediator. The method responsible for completing the surface-behind remote animation does not correctly validate that keyguard dismissal conditions have been satisfied before finalizing the unlock state. This category of flaw is classified as [CWE-693: Protection Mechanism Failure].
Attack Vector
Exploitation requires local access to the target device. No user interaction is needed, and no privileges are required prior to exploitation. An attacker with physical access to a locked device, or code running on the device that can trigger the affected animation path, can drive the keyguard into an inconsistent state and bypass the lockscreen.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed technical information is available in the Android Security Bulletin March 2026.
Detection Methods for CVE-2025-48602
Indicators of Compromise
- Unexpected unlock events in the system logs without corresponding biometric or PIN authentication entries.
- Keyguard state transitions logged by KeyguardViewMediator that do not match user-initiated unlock actions.
- Access to user data or protected APIs from a device that telemetry indicates should be in a locked state.
Detection Strategies
- Audit Android device telemetry for unlock events that are not preceded by an authentication factor.
- Monitor mobile device management (MDM) attestation reports for devices running unpatched Android 14, 15, or 16 builds.
- Correlate KeyguardViewMediator lifecycle events with authentication subsystem logs to identify inconsistencies.
Monitoring Recommendations
- Enforce MDM policies that report Android security patch level and flag devices missing the March 2026 update.
- Alert on installation of applications requesting accessibility or system-overlay permissions on unpatched devices.
- Track repeated lockscreen interaction patterns that may indicate attempts to trigger the vulnerable animation path.
How to Mitigate CVE-2025-48602
Immediate Actions Required
- Apply the March 2026 Android security patch on all managed devices running Android 14, 15, or 16.
- Remove Android 16 QPR2 beta builds from production fleets until the patched release is installed.
- Enforce device-level policies that require the latest security patch level before granting access to corporate resources.
Patch Information
Google released a fix for CVE-2025-48602 in the March 2026 Android Security Bulletin. Devices must be updated to a security patch level of 2026-03-01 or later. OEM rollouts vary, so administrators should validate patch availability with each device vendor. See the Android Security Bulletin March 2026 for full details.
Workarounds
- No vendor-supplied workaround exists. Restrict physical access to devices that cannot yet receive the March 2026 patch.
- Disable installation of untrusted applications on unpatched devices to reduce the local attack surface.
- Use MDM conditional access to block unpatched devices from accessing sensitive corporate data until the update is applied.
# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-03-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
