CVE-2025-48574
Published: 02 March 2026
Summary
CVE-2025-48574 is a high-severity Missing Authorization (CWE-862) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources, directly addressing the missing permission check in validateAddingWindowLw that allows unauthorized interception of drag-and-drop events.
Implements a reference monitor to mediate all accesses to display policy functions, preventing unprivileged apps from adding windows to escalate privileges via event interception.
Requires timely identification, reporting, and correction of flaws like this missing authorization, including application of patches from the Android March 2026 security bulletin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization check directly enables local exploitation of the Android component for privilege escalation without user interaction or prior privileges.
NVD Description
In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
Deeper analysisAI
CVE-2025-48574 is a vulnerability in the validateAddingWindowLw function of DisplayPolicy.java within Android. It arises from a missing permission check that enables an application to intercept drag-and-drop events. This flaw could lead to local escalation of privilege, requiring no additional execution privileges and no user interaction for exploitation. The issue is scored at CVSS 3.1 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862 (Missing Authorization).
A local attacker with access to the device can exploit this vulnerability by installing and running a malicious app. Given the low attack complexity, lack of required privileges, and absence of user interaction, the attacker can achieve high impacts on confidentiality, integrity, and availability via privilege escalation.
The Android March 2026 security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 details available patches and mitigation guidance for this vulnerability.
Details
- CWE(s)