CVE-2025-48579
Published: 02 March 2026
Summary
CVE-2025-48579 is a high-severity Confused Deputy (CWE-441) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to external storage resources, directly preventing the confused deputy permission bypass in MediaProvider.java functions.
Implements a reference monitor to mediate and validate all access requests, countering the confused deputy vulnerability by ensuring tamper-proof enforcement of permissions.
Provides for timely remediation of the specific flaw in MediaProvider.java, as detailed in the Android security bulletin, to eliminate the escalation path.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via permission bypass (confused deputy) without user interaction or prior privileges, matching Exploitation for Privilege Escalation.
NVD Description
In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2025-48579 is a vulnerability in multiple functions of MediaProvider.java within Android, stemming from a confused deputy issue (CWE-441) that enables bypassing external storage write permissions. Published on 2026-03-02, it allows local escalation of privilege without requiring additional execution privileges or user interaction, earning a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Local attackers can exploit this vulnerability with low complexity and no privileges, as it requires only local access to the device. Successful exploitation leads to high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution or data manipulation at elevated privilege levels.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 details available patches and mitigation guidance for affected Android versions.
Details
- CWE(s)