CVE-2025-48640

HIGH

Android Missing Permission Check on Passkey Entry Pairing Approval

Generated titleSource: EIP title enrichment
STIX 2.1 vulnerability

Record summary

CVE-2025-48640 has a selected CVSS score of 8.0 (high).

Description

In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 17, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Android

Browse Google / Android

Default status: unaffected

CVE List17affected

References

2