CVE-2025-48646
Published: 02 March 2026
Summary
CVE-2025-48646 is a high-severity Confused Deputy (CWE-441) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-48646 is a vulnerability in the executeRequest method of ActivityStarter.java within Android, caused by a confused deputy issue (CWE-441). This flaw enables arbitrary app launching, potentially leading to local escalation of privilege without requiring additional execution privileges from the attacker. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-03-02.
A local attacker can exploit this vulnerability by tricking a user into interacting with a malicious app or trigger, such as clicking a specific intent or activity. No privileged access is needed beforehand, but user interaction is required to invoke the vulnerable code path in ActivityStarter. Successful exploitation allows the attacker to gain elevated privileges on the device, resulting in high impacts to confidentiality, integrity, and availability.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 provides details on affected versions and available patches to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208220
Vulnerability details
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local confused deputy flaw enabling arbitrary app launch for privilege escalation without prior privileges (AV:L), directly matching Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access Enforcement requires verification of caller privileges before processing requests in ActivityStarter, directly preventing the confused deputy from enabling arbitrary app launches and privilege escalation.
Least Privilege restricts ActivityStarter to only perform actions necessary for authorized tasks, mitigating local escalation by limiting the scope of untrusted requests.
Flaw Remediation ensures timely identification, reporting, and patching of the specific confused deputy vulnerability in executeRequest as detailed in the Android security bulletin.