CVE-2025-48605
Published: 02 March 2026
Summary
CVE-2025-48605 is a high-severity Protection Mechanism Failure (CWE-693) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-11 (Device Lock) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely flaw remediation including application of patches for the specific logic error in KeyguardViewMediator.java detailed in the Android security bulletin.
Mandates enforcement of device lock after inactivity to directly counter lockscreen bypass vulnerabilities like the KeyguardViewMediator logic error.
Enforces approved authorizations for system access, addressing the protection mechanism failure in KeyguardViewMediator that allows privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The lockscreen bypass logic flaw directly enables local exploitation for privilege escalation (T1068) with no authentication required.
NVD Description
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2025-48605 is a logic error in multiple functions of KeyguardViewMediator.java that enables a lockscreen bypass. This vulnerability affects the Android operating system, specifically components handling keyguard mediation. It is classified under CWE-693 (Protection Mechanism Failure) and was published on 2026-03-02 with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A local attacker can exploit this vulnerability with low complexity, no privileges, and no user interaction required. Successful exploitation leads to local escalation of privilege, granting high-impact access to confidentiality, integrity, and availability through the lockscreen bypass.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 details available patches and mitigation guidance for affected Android versions.
Details
- CWE(s)