CVE-2025-48654
Published: 02 March 2026
Summary
CVE-2025-48654 is a high-severity Externally Controlled Reference to a Resource in Another Sphere (CWE-610) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-48654 is a logic error in the onStart method of CompanionDeviceManagerService.java within Android, resulting in a confused deputy vulnerability. This flaw enables local escalation of privilege without requiring additional execution privileges or user interaction, as detailed in its description published on 2026-03-02. The issue is associated with CWEs NVD-CWE-noinfo and CWE-610, and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges, such as one running a malicious app on the device, can exploit this vulnerability due to its low attack complexity and lack of need for user interaction. Exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially elevating privileges to compromise the system more broadly.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 addresses this vulnerability, providing information on available patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208223
Vulnerability details
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of logic flaw in system service (confused deputy).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
The logic error in onStart of CompanionDeviceManagerService constitutes a failure to enforce approved access authorizations, directly enabling the confused deputy privilege escalation.
Flaw remediation directly corrects the specific logic error in CompanionDeviceManagerService.java as addressed by the Android security bulletin patch.
Least privilege limits the privileges exploitable via the confused deputy mechanism in CompanionDeviceManagerService, reducing escalation impact.