{"id":"ASB-A-353680402","details":"In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-353680402","CVE-2025-48535"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/25ed933c4cf5acb7a15c146332f9586f3dd1abe0"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b7240e2f0c50455a1c8f3ae1fc4f27d55b86e89b","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false,"digest":{"length":583,"function_hash":"167051775218518309602972445688464531447"},"id":"ASB-A-353680402-1a5f3406","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/b7240e2f0c50455a1c8f3ae1fc4f27d55b86e89b","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["87249741624904178570740848043246456225","322900107720807731356549153451401585236","30641909703164034095131522789235472829","312449678066938024485074749804097670041","204461751170142905684839284015484469701","275251800527781872931916296749898367687","276736092446101932266423162397011781416","220607371548842682738531909079559250648","193851804838495652505114225811346447401","335330703028102328901877311581203144736"],"threshold":0.9},"id":"ASB-A-353680402-97e00931","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/b7240e2f0c50455a1c8f3ae1fc4f27d55b86e89b"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-353680402.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["87249741624904178570740848043246456225","322900107720807731356549153451401585236","30641909703164034095131522789235472829","312449678066938024485074749804097670041","204461751170142905684839284015484469701","275251800527781872931916296749898367687","276736092446101932266423162397011781416","220607371548842682738531909079559250648","193851804838495652505114225811346447401","335330703028102328901877311581203144736"],"threshold":0.9},"id":"ASB-A-353680402-8a2b1021","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/9a2ddc6aab7950ab3c527321d4eab8e578097936"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/9a2ddc6aab7950ab3c527321d4eab8e578097936","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false,"digest":{"function_hash":"167051775218518309602972445688464531447","length":583},"id":"ASB-A-353680402-8d0f6de5"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/9a2ddc6aab7950ab3c527321d4eab8e578097936"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-353680402.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"167051775218518309602972445688464531447","length":583},"id":"ASB-A-353680402-1ad0895b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d8166274a030372f9b1184137fceef9d4dac83e1","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/d8166274a030372f9b1184137fceef9d4dac83e1","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"line_hashes":["87249741624904178570740848043246456225","322900107720807731356549153451401585236","30641909703164034095131522789235472829","312449678066938024485074749804097670041","204461751170142905684839284015484469701","275251800527781872931916296749898367687","276736092446101932266423162397011781416","220607371548842682738531909079559250648","193851804838495652505114225811346447401","335330703028102328901877311581203144736"],"threshold":0.9},"id":"ASB-A-353680402-bcccbde6","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/d8166274a030372f9b1184137fceef9d4dac83e1"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-353680402.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["87249741624904178570740848043246456225","322900107720807731356549153451401585236","30641909703164034095131522789235472829","312449678066938024485074749804097670041","204461751170142905684839284015484469701","275251800527781872931916296749898367687","276736092446101932266423162397011781416","220607371548842682738531909079559250648","193851804838495652505114225811346447401","335330703028102328901877311581203144736"],"threshold":0.9},"id":"ASB-A-353680402-b0306cd4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4dddd8cbc6757a06b92acf7f77f4bbecb363ed6c","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"}},{"deprecated":false,"digest":{"function_hash":"167051775218518309602972445688464531447","length":583},"id":"ASB-A-353680402-d478113e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/4dddd8cbc6757a06b92acf7f77f4bbecb363ed6c","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/4dddd8cbc6757a06b92acf7f77f4bbecb363ed6c"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-353680402.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/96fb144d425f91b124aaab9d56f0305535e6b453","target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["87249741624904178570740848043246456225","322900107720807731356549153451401585236","30641909703164034095131522789235472829","312449678066938024485074749804097670041","204461751170142905684839284015484469701","275251800527781872931916296749898367687","276736092446101932266423162397011781416","220607371548842682738531909079559250648","193851804838495652505114225811346447401","335330703028102328901877311581203144736"]},"id":"ASB-A-353680402-0273d775","signature_type":"Line"},{"target":{"file":"src/com/android/settings/users/AppRestrictionsFragment.java","function":"assertSafeToStartCustomActivity"},"deprecated":false,"digest":{"function_hash":"167051775218518309602972445688464531447","length":583},"id":"ASB-A-353680402-9a42fcc0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/96fb144d425f91b124aaab9d56f0305535e6b453"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/96fb144d425f91b124aaab9d56f0305535e6b453"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-353680402.json"}}],"schema_version":"1.9.0"}