CVE-2025-48618

MEDIUM

Java - Privilege Escalation

Title source: llm

Description

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References (2)

[Patch, Product] https://android.googlesource.com/platform/frameworks/opt/telephony/+/fee68bcdcf029e8f40980616d09367610544bc62

[Vendor Advisory] https://source.android.com/security/bulletin/2025-12-01

Scores

CVSS v3 6.8

EPSS 0.0001

EPSS Percentile 0.9%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-667

Status published

Affected Products (4)

google/android

Timeline

Published Dec 08, 2025

Tracked Since Feb 18, 2026