{"id":"ASB-A-339637822","details":"In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use abuse. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-339637822","CVE-2025-48573"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/039030a6b0e7d255af70609a3607e805ad2a99ff"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ef878077fe520900d783f8a4ad15a97be338ba29"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"line_hashes":["295663147934602901587685930669195904430","300644691175556851590189198817654268614","274794278707599360813111154090886855229","98575725188023173122146020946782549228","95538261545296973792931279416195847451","251042773400171008829640301421303257542","286826685401867512882207169272084512588","217209414885596656948544539395390919157","270534985031001244675366669005810674762"],"threshold":0.9},"id":"ASB-A-339637822-2c43a5b0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ef878077fe520900d783f8a4ad15a97be338ba29"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ef878077fe520900d783f8a4ad15a97be338ba29","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java","function":"sendCommand"},"deprecated":false,"digest":{"length":412,"function_hash":"91563271606762283751811484693224499195"},"id":"ASB-A-339637822-b0ec8938"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-339637822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/52fbff99bc75c97b593c566c14973a2a2dbdd524","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["98575725188023173122146020946782549228","95538261545296973792931279416195847451","251042773400171008829640301421303257542","286826685401867512882207169272084512588","217209414885596656948544539395390919157","270534985031001244675366669005810674762"]},"id":"ASB-A-339637822-e9659296"},{"target":{"function":"sendCommand","file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"function_hash":"91563271606762283751811484693224499195","length":412},"id":"ASB-A-339637822-fd04f21d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/52fbff99bc75c97b593c566c14973a2a2dbdd524"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/52fbff99bc75c97b593c566c14973a2a2dbdd524"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-339637822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/67427c408ade557307d44b632addbabfcd825cbf"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["98575725188023173122146020946782549228","95538261545296973792931279416195847451","251042773400171008829640301421303257542","286826685401867512882207169272084512588","217209414885596656948544539395390919157","270534985031001244675366669005810674762"],"threshold":0.9},"id":"ASB-A-339637822-36b60446","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/67427c408ade557307d44b632addbabfcd825cbf","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/67427c408ade557307d44b632addbabfcd825cbf","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java","function":"sendCommand"},"deprecated":false,"digest":{"function_hash":"91563271606762283751811484693224499195","length":412},"id":"ASB-A-339637822-97951981","signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-339637822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154","target":{"function":"sendCommand","file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"function_hash":"291510612482705506915375350621778202628","length":411},"id":"ASB-A-339637822-58036a17","signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"line_hashes":["98575725188023173122146020946782549228","95538261545296973792931279416195847451","251042773400171008829640301421303257542","286826685401867512882207169272084512588","217209414885596656948544539395390919157","274623443125498352259103935175234676367"],"threshold":0.9},"id":"ASB-A-339637822-9c2fdb06","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-339637822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java"},"deprecated":false,"digest":{"line_hashes":["98575725188023173122146020946782549228","95538261545296973792931279416195847451","251042773400171008829640301421303257542","286826685401867512882207169272084512588","217209414885596656948544539395390919157","274623443125498352259103935175234676367"],"threshold":0.9},"id":"ASB-A-339637822-7864580f","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"291510612482705506915375350621778202628","length":411},"id":"ASB-A-339637822-d4c163ab","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154","target":{"file":"services/core/java/com/android/server/media/MediaSessionRecord.java","function":"sendCommand"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-339637822.json"}}],"schema_version":"1.9.0"}