CVE-2025-48602
Published: 02 March 2026
Summary
CVE-2025-48602 is a high-severity Protection Mechanism Failure (CWE-693) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-11 (Device Lock) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of system flaws like the logic error in KeyguardViewMediator.java, directly preventing exploitation via patching as noted in the Android security bulletin.
Mandates enforcement of device locks after inactivity and protection of information while locked, directly countering the lockscreen bypass vulnerability.
Enforces approved authorizations for access to system resources, addressing the logic error that fails to prevent unauthorized local privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of authentication bypass logic error.
NVD Description
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2025-48602 is a logic error in the exitKeyguardAndFinishSurfaceBehindRemoteAnimation function of KeyguardViewMediator.java within the Android Open Source Project. This vulnerability enables a lockscreen bypass, potentially leading to local escalation of privilege without requiring additional execution privileges. It has been assigned a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-693 (Protection Mechanism Failure). The issue was published on 2026-03-02.
A local attacker can exploit this vulnerability with low complexity and no user interaction or privileges needed. Successful exploitation allows bypassing the lockscreen, resulting in high impacts on confidentiality, integrity, and availability through local privilege escalation.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 provides details on affected versions and available patches for mitigation.
Details
- CWE(s)