Cyber Posture

CVE-2025-48654

High

Published: 02 March 2026

Published
02 March 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0000 0.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48654 is a high-severity Externally Controlled Reference to a Resource in Another Sphere (CWE-610) vulnerability in Google Android. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

The logic error in onStart of CompanionDeviceManagerService constitutes a failure to enforce approved access authorizations, directly enabling the confused deputy privilege escalation.

prevent

Flaw remediation directly corrects the specific logic error in CompanionDeviceManagerService.java as addressed by the Android security bulletin patch.

prevent

Least privilege limits the privileges exploitable via the confused deputy mechanism in CompanionDeviceManagerService, reducing escalation impact.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct local privilege escalation via exploitation of logic flaw in system service (confused deputy).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Deeper analysisAI

CVE-2025-48654 is a logic error in the onStart method of CompanionDeviceManagerService.java within Android, resulting in a confused deputy vulnerability. This flaw enables local escalation of privilege without requiring additional execution privileges or user interaction, as detailed in its description published on 2026-03-02. The issue is associated with CWEs NVD-CWE-noinfo and CWE-610, and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges, such as one running a malicious app on the device, can exploit this vulnerability due to its low attack complexity and lack of need for user interaction. Exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially elevating privileges to compromise the system more broadly.

The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 addresses this vulnerability, providing information on available patches and mitigation steps.

Details

CWE(s)

Affected Products

google
android
16.0

CVEs Like This One

CVE-2025-48574Same product: Google Android
CVE-2025-36920Same product: Google Android
CVE-2026-0011Same product: Google Android
CVE-2026-0020Same product: Google Android
CVE-2026-0117Same product: Google Android
CVE-2024-53833Same product: Google Android
CVE-2026-0010Same product: Google Android
CVE-2026-0037Same product: Google Android
CVE-2025-48577Same product: Google Android
CVE-2024-49742Same product: Google Android

References