CVE-2025-48635
Published: 02 March 2026
Summary
CVE-2025-48635 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Google Android. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-48635 is a logic error in multiple functions of TaskFragmentOrganizerController.java that enables a possible activity token leak. This vulnerability affects the Android operating system.
A local attacker requires no additional execution privileges and no user interaction to exploit the issue, which has low attack complexity. Successful exploitation leads to local escalation of privilege, resulting in high impacts to confidentiality and integrity but no availability impact, as reflected in its CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The issue is associated with CWEs 200, 532, and 693.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 provides details on affected versions and available patches for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208214
Vulnerability details
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
more
exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Logic error enabling local activity token leak directly facilitates exploitation for privilege escalation (T1068) on Android with no user interaction required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the logic error in TaskFragmentOrganizerController.java by identifying, reporting, and applying the vendor patch from the Android security bulletin to prevent token leaks and privilege escalation.
Enforces approved access authorizations, directly countering the activity token leak that enables local escalation of privilege via improper access control logic.
Limits the impact of privilege escalation from the token leak by ensuring processes and users operate with least privileges necessary.