CVE-2025-48650
Published: 02 March 2026
Summary
CVE-2025-48650 is a high-severity SQL Injection (CWE-89) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection vulnerabilities like CVE-2025-48650 by requiring validation and sanitization of all inputs to Android components before SQL query construction.
Mandates timely flaw remediation, including application of patches from the Android security bulletin to eliminate the specific SQL injection issue.
Enforces restrictions on input types, formats, and lengths to block malicious SQL payloads from being processed in affected Android components.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability directly enables local privilege escalation on Android without privileges or interaction, mapping to T1068.
NVD Description
In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2025-48650 is a SQL injection vulnerability (CWE-89) present in multiple locations within Android components, enabling potential information disclosure. This issue, published on 2026-03-02, carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H), indicating high confidentiality, integrity, and availability impacts from local access.
A local attacker can exploit this vulnerability without requiring additional execution privileges or user interaction. Successful exploitation could lead to local escalation of privilege, allowing the attacker to gain elevated access on the affected Android device.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 provides details on affected versions and available patches for mitigation.
Details
- CWE(s)