CVE-2025-48578
Published: 02 March 2026
Summary
CVE-2025-48578 is a high-severity Missing Authorization (CWE-862) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 mandates enforcement of approved authorizations for access to system resources, directly addressing the missing permission check in MediaProvider.java that allowed bypassing WRITE_EXTERNAL_STORAGE.
AC-6 enforces least privilege to restrict unnecessary access, mitigating the local privilege escalation enabled by the flawed permission bypass.
SI-2 requires identification, reporting, and correction of system flaws like the missing authorization check, with patches provided in the Android security bulletin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing permission check enables local exploitation for privilege escalation (T1068) by bypassing WRITE_EXTERNAL_STORAGE authorization.
NVD Description
In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for…
more
exploitation.
Deeper analysisAI
CVE-2025-48578 is a vulnerability in multiple functions of MediaProvider.java within the Android platform, stemming from a missing permission check that enables bypassing the WRITE_EXTERNAL_STORAGE permission. This flaw could result in local escalation of privilege without requiring additional execution privileges. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H) and is associated with CWE-862 (Missing Authorization).
A local attacker can exploit this vulnerability with low complexity and no privileges, though user interaction is required. Successful exploitation allows the attacker to gain elevated access, potentially compromising high levels of confidentiality, integrity, and availability on the affected device.
The Android security bulletin for March 2026, available at https://source.android.com/docs/security/bulletin/2026/2026-03-01, provides details on patches and mitigations for this issue.
Details
- CWE(s)