Cyber Posture

CVE-2025-48653

High

Published: 02 March 2026

Published
02 March 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0000 0.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48653 is a high-severity Protection Mechanism Failure (CWE-693) vulnerability in Google Android. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely identification, reporting, and correction of system flaws directly remediates the logic error in loadDataAndPostValue functions that obscures permission usage and enables local privilege escalation.

prevent

Enforces approved authorizations for logical access, directly countering the permission obscuring logic error that bypasses privilege checks.

prevent

Restricts system access to least privilege necessary, limiting the scope and impact of escalation from low-privilege local attackers exploiting the flawed permission logic.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Logic flaw directly enables local privilege escalation via permission abuse on the affected platform.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…

more

needed for exploitation.

Deeper analysisAI

CVE-2025-48653 is a logic error in the loadDataAndPostValue function across multiple files that enables obscuring permission usage. This vulnerability affects Android devices and could lead to local escalation of privilege with no additional execution privileges or user interaction required. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H) and is linked to CWEs NVD-CWE-noinfo and CWE-693.

A local attacker with low privileges on an affected Android device can exploit this issue due to its low complexity and lack of user interaction requirements. Exploitation allows high-impact confidentiality, integrity, and availability violations, enabling privilege escalation within the local scope.

The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 advises applying the March 2026 security patch to mitigate the vulnerability in supported Android versions.

Details

CWE(s)

Affected Products

google
android
14.0, 15.0, 16.0

CVEs Like This One

CVE-2026-0118Same product: Google Android
CVE-2025-48602Same product: Google Android
CVE-2025-48605Same product: Google Android
CVE-2026-0011Same product: Google Android
CVE-2025-48626Same product: Google Android
CVE-2026-0017Same product: Google Android
CVE-2025-48635Same product: Google Android
CVE-2025-48574Same product: Google Android
CVE-2025-36920Same product: Google Android
CVE-2026-0020Same product: Google Android

References