{"id":"ASB-A-326571066","details":"In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-326571066","CVE-2025-48627"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/d34ae40f870d4362a069940a035a4d58a536a231"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d34ae40f870d4362a069940a035a4d58a536a231","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"startNextMatchingActivity"},"deprecated":false,"digest":{"function_hash":"125986606726625882285234545796372220868","length":3049},"id":"ASB-A-326571066-3e815315","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/d34ae40f870d4362a069940a035a4d58a536a231","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"line_hashes":["38744322835598934261403143159623226430","319403857700301660382094419642529203765","258830789992759248493789321732060780627","30767152278663014052777514754286447248","333186094094834558329410338961478831156","156801257386743303490337615679846431758","277619237961344534668546512755178425564","233392774852901342234222876334376782423","143294482730940875398179024393826938036","266500950927352471030922760289034248797","155407033172669539942562292483222869242","305036455271346379281266795436063368708"],"threshold":0.9},"id":"ASB-A-326571066-5c811f8a","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d34ae40f870d4362a069940a035a4d58a536a231"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326571066.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/916e96afc82f99deef42d889b1206b50c03f8209","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"startNextMatchingActivity"},"deprecated":false,"digest":{"function_hash":"226137044291057222073173857474781459336","length":2945},"id":"ASB-A-326571066-7e2b9ee3","signature_type":"Function"},{"target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38744322835598934261403143159623226430","319403857700301660382094419642529203765","258830789992759248493789321732060780627","43787942809969134241995743940759675676","296249654319491159679879059860441239785","30767152278663014052777514754286447248","333186094094834558329410338961478831156","156801257386743303490337615679846431758","277619237961344534668546512755178425564","233392774852901342234222876334376782423","143294482730940875398179024393826938036","266500950927352471030922760289034248797","252846042200044892050975798432609940730","336331804868354126233717638681934759592"]},"id":"ASB-A-326571066-c21dcabc","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/916e96afc82f99deef42d889b1206b50c03f8209"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/916e96afc82f99deef42d889b1206b50c03f8209"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326571066.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/008a27811ad65dd826f040b7d1e7366b0c9f917e","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java","function":"startNextMatchingActivity"},"deprecated":false,"digest":{"function_hash":"226137044291057222073173857474781459336","length":2945},"id":"ASB-A-326571066-14bfa2d8","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-326571066-ff94ccd2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/008a27811ad65dd826f040b7d1e7366b0c9f917e","target":{"file":"services/core/java/com/android/server/wm/ActivityTaskManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38744322835598934261403143159623226430","319403857700301660382094419642529203765","258830789992759248493789321732060780627","43787942809969134241995743940759675676","296249654319491159679879059860441239785","30767152278663014052777514754286447248","333186094094834558329410338961478831156","156801257386743303490337615679846431758","277619237961344534668546512755178425564","177809087579538070238245537243034007378","269362116107589722058194574776708902081","53221371259381438459360905865126339575","155046736446939757154999034983477504036","64531953434324119995642499705604382882","333516042649489253463512250328517668790","311103090027810912653217446501431600245","311545419293262592779433611898598004330","64422315487152615121553626652131733082","233392774852901342234222876334376782423","143294482730940875398179024393826938036","266500950927352471030922760289034248797","252846042200044892050975798432609940730","336331804868354126233717638681934759592","146113047732805261016662476579002387606","280989723271764441248974080608782019831"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/008a27811ad65dd826f040b7d1e7366b0c9f917e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-326571066.json"}}],"schema_version":"1.9.0"}