{"id":"ASB-A-352024705","details":"In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-352024705","CVE-2025-48620"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/db86972777c84a386d8a6d2d34879923bdbccdf6"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/84dd2b90f4a2ea1ebc5b78f08f14c5a3b92c9c2d"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e8d07dd802a9172e68a9a043804fe11c48180e7f"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/e8d07dd802a9172e68a9a043804fe11c48180e7f","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["101788554162910092734093882272841117109","119005825486589151620228838390581756434","304252756757612834410724629089640339005","179797783870667184229170925445375805360","77106791831560109059104875773774649827","170387982052049123434295160449839755629"],"threshold":0.9},"id":"ASB-A-352024705-a316b3e9","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e8d07dd802a9172e68a9a043804fe11c48180e7f","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"onSomePackagesChanged"},"deprecated":false,"digest":{"function_hash":"204530730967339533025765209779150623014","length":1396},"id":"ASB-A-352024705-d5a2883d","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352024705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bf498d463e57951ce6b452f0c19f82079d65f4d6","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"onSomePackagesChanged"},"deprecated":false,"digest":{"function_hash":"204530730967339533025765209779150623014","length":1396},"id":"ASB-A-352024705-53088d92"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/bf498d463e57951ce6b452f0c19f82079d65f4d6","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["101788554162910092734093882272841117109","119005825486589151620228838390581756434","304252756757612834410724629089640339005","179797783870667184229170925445375805360","77106791831560109059104875773774649827","170387982052049123434295160449839755629"],"threshold":0.9},"id":"ASB-A-352024705-83d16834","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bf498d463e57951ce6b452f0c19f82079d65f4d6"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352024705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"204530730967339533025765209779150623014","length":1396},"id":"ASB-A-352024705-30e3afdf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/60977ee40757c2d30294e1ed7f5d1865b70e59b5","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"onSomePackagesChanged"}},{"digest":{"line_hashes":["101788554162910092734093882272841117109","119005825486589151620228838390581756434","304252756757612834410724629089640339005","179797783870667184229170925445375805360","77106791831560109059104875773774649827","170387982052049123434295160449839755629"],"threshold":0.9},"id":"ASB-A-352024705-f284d9a1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/60977ee40757c2d30294e1ed7f5d1865b70e59b5","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/60977ee40757c2d30294e1ed7f5d1865b70e59b5"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352024705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"157549993435262806623670035902666404702","length":1382},"id":"ASB-A-352024705-57172f7f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e96c4a0513a87fe7ee4f2f259d6eccbf47c3d7d","target":{"function":"onSomePackagesChanged","file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"}},{"target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["101788554162910092734093882272841117109","119005825486589151620228838390581756434","304252756757612834410724629089640339005","179797783870667184229170925445375805360","77106791831560109059104875773774649827","170387982052049123434295160449839755629"]},"id":"ASB-A-352024705-88c9c0d6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e96c4a0513a87fe7ee4f2f259d6eccbf47c3d7d"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5e96c4a0513a87fe7ee4f2f259d6eccbf47c3d7d"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352024705.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"157549993435262806623670035902666404702","length":1382},"id":"ASB-A-352024705-83060441","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5e96c4a0513a87fe7ee4f2f259d6eccbf47c3d7d","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"onSomePackagesChanged"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/5e96c4a0513a87fe7ee4f2f259d6eccbf47c3d7d","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["101788554162910092734093882272841117109","119005825486589151620228838390581756434","304252756757612834410724629089640339005","179797783870667184229170925445375805360","77106791831560109059104875773774649827","170387982052049123434295160449839755629"],"threshold":0.9},"id":"ASB-A-352024705-f7f30413","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5e96c4a0513a87fe7ee4f2f259d6eccbf47c3d7d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352024705.json"}}],"schema_version":"1.9.0"}