CVE-2025-48621

State: Published
Severity: 7.3 High
Published: Dec 8, 2025
Updated: Dec 17, 2025
Reserved: May 22, 2025

Description

In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-1188 Initialization of a Resource with an Insecure Default

Affected Products

Product	Versions
AndroidGoogle	16Affected 15Affected 14Affected 13Affected

References

https://android.googlesource.com/platform/frameworks/native/+/cc34c7b416b964c05a42ae3e9c2929b59b92c64f
https://android.googlesource.com/platform/frameworks/base/+/6d1697c96c5cae5062f6aea58cf2665b7d646cb8
https://source.android.com/security/bulletin/2025-12-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.