{"id":"ASB-A-380885270","details":"In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-380885270","CVE-2025-48558"],"modified":"2026-05-27T15:53:17.428190120Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/b1c60eeadb2c94113ce74c0f6a03b39a0e8ae727"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/8cda6fda96c420588a5f8f5112522cfde14659b4"],"types":["EoP"],"severity":"High","vanir_signatures":[{"signature_type":"Line","id":"ASB-A-380885270-1ebd9000","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["80759791692468733492985726240634296516","328967283693661141864091776869430698938","189586162725560555251985529673111286599","196240744251274231338500046976963882883","173498981034156296133761297344379387728","153123523969430824723063138912374801121","94107306677305615451167231060175210696","110873781035025277549805130370678947934","155536508438028668751362241517294767956","48250072535440157564402516877884107078","36257687874367359908022397307060047710","304912876339585875160856943620407474340","246794235343814810740646112638158135300","127344443528582515039795652130552324568","316453581610428437326697987347551003280","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","7795229225593532171432182667904221605","223628502647132815961524499971318274078","209454432448306903235689052172987767869","278192999760310086927461722870914959805","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","16043719861345451608322868997224660696","291706465764554476319457593145407180363","239647385265092697034714632699843125226","266576849370593649080929628771659396745","229695016226321857641966657150699753045","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","143626308501198079237304467303923576933","335666883964392262919991900490441551701","69648412047852628610350404481839617819","289632595868881864486607811902758267751","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","248348207169644647820334839616750828609","198096343837687942658286708646879538277","137160856444807901352976806384388879000"]},"target":{"file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/8cda6fda96c420588a5f8f5112522cfde14659b4","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-25d9c6ff","target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"digest":{"length":383,"function_hash":"295841275048368171116493633018900901982"},"source":"https://android.googlesource.com/platform/frameworks/base/+/8cda6fda96c420588a5f8f5112522cfde14659b4","signature_version":"v1","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-958cc664","source":"https://android.googlesource.com/platform/frameworks/base/+/8cda6fda96c420588a5f8f5112522cfde14659b4","digest":{"length":373,"function_hash":"58642636936553668812422262972062789017"},"signature_version":"v1","target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-a5449fa8","signature_version":"v1","digest":{"length":517,"function_hash":"289966756219251004989797386375447860513"},"target":{"function":"shutdownIfNoPowerLocked","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/8cda6fda96c420588a5f8f5112522cfde14659b4","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-a9c84219","signature_version":"v1","digest":{"length":590,"function_hash":"193857023774587833305249268330514252802"},"target":{"function":"shutdownIfOverTempLocked","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/8cda6fda96c420588a5f8f5112522cfde14659b4","deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-380885270.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-09-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/970105e708dc495851797364e73a29aa93d43d8c"],"types":["EoP"],"severity":"High","vanir_signatures":[{"signature_type":"Line","id":"ASB-A-380885270-051adaa7","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["80759791692468733492985726240634296516","328967283693661141864091776869430698938","189586162725560555251985529673111286599","196240744251274231338500046976963882883","236039801213343863761034186504008567160","117087061417595918025586080061858790204","94107306677305615451167231060175210696","110873781035025277549805130370678947934","155536508438028668751362241517294767956","48250072535440157564402516877884107078","211847024995932425340774748033947928514","147733005593394715908905131377040780289","246794235343814810740646112638158135300","127344443528582515039795652130552324568","316453581610428437326697987347551003280","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","7795229225593532171432182667904221605","223628502647132815961524499971318274078","209454432448306903235689052172987767869","278192999760310086927461722870914959805","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","16043719861345451608322868997224660696","291706465764554476319457593145407180363","239647385265092697034714632699843125226","266576849370593649080929628771659396745","229695016226321857641966657150699753045","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","143626308501198079237304467303923576933","335666883964392262919991900490441551701","69648412047852628610350404481839617819","289632595868881864486607811902758267751","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","22322805835170439058240275151559616767","63469913034047310311306701554525206213","153358400981321589894658350660472319107"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/970105e708dc495851797364e73a29aa93d43d8c","target":{"file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-1826f89c","source":"https://android.googlesource.com/platform/frameworks/base/+/970105e708dc495851797364e73a29aa93d43d8c","digest":{"length":590,"function_hash":"193857023774587833305249268330514252802"},"signature_version":"v1","target":{"function":"shutdownIfOverTempLocked","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-44658825","signature_version":"v1","digest":{"length":373,"function_hash":"58642636936553668812422262972062789017"},"source":"https://android.googlesource.com/platform/frameworks/base/+/970105e708dc495851797364e73a29aa93d43d8c","target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-ab3ea1ba","signature_version":"v1","digest":{"length":517,"function_hash":"289966756219251004989797386375447860513"},"target":{"function":"shutdownIfNoPowerLocked","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/970105e708dc495851797364e73a29aa93d43d8c","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-bd5950af","signature_version":"v1","digest":{"length":383,"function_hash":"295841275048368171116493633018900901982"},"target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/970105e708dc495851797364e73a29aa93d43d8c","deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-380885270.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9ddccd084b56e900ee4f6134976524aae8527ae1"],"severity":"High","vanir_signatures":[{"signature_type":"Function","id":"ASB-A-380885270-066a0375","source":"https://android.googlesource.com/platform/frameworks/base/+/9ddccd084b56e900ee4f6134976524aae8527ae1","digest":{"length":517,"function_hash":"289966756219251004989797386375447860513"},"signature_version":"v1","target":{"function":"shutdownIfNoPowerLocked","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Line","id":"ASB-A-380885270-1d439804","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["80759791692468733492985726240634296516","328967283693661141864091776869430698938","189586162725560555251985529673111286599","196240744251274231338500046976963882883","173498981034156296133761297344379387728","153123523969430824723063138912374801121","94107306677305615451167231060175210696","110873781035025277549805130370678947934","155536508438028668751362241517294767956","48250072535440157564402516877884107078","36257687874367359908022397307060047710","304912876339585875160856943620407474340","246794235343814810740646112638158135300","127344443528582515039795652130552324568","316453581610428437326697987347551003280","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","7795229225593532171432182667904221605","223628502647132815961524499971318274078","209454432448306903235689052172987767869","278192999760310086927461722870914959805","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","16043719861345451608322868997224660696","291706465764554476319457593145407180363","239647385265092697034714632699843125226","266576849370593649080929628771659396745","229695016226321857641966657150699753045","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","143626308501198079237304467303923576933","335666883964392262919991900490441551701","69648412047852628610350404481839617819","289632595868881864486607811902758267751","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","248348207169644647820334839616750828609","198096343837687942658286708646879538277","137160856444807901352976806384388879000"]},"target":{"file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/9ddccd084b56e900ee4f6134976524aae8527ae1","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-9d5e2c86","signature_version":"v1","digest":{"length":590,"function_hash":"193857023774587833305249268330514252802"},"source":"https://android.googlesource.com/platform/frameworks/base/+/9ddccd084b56e900ee4f6134976524aae8527ae1","target":{"function":"shutdownIfOverTempLocked","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-fb235fa2","source":"https://android.googlesource.com/platform/frameworks/base/+/9ddccd084b56e900ee4f6134976524aae8527ae1","digest":{"length":373,"function_hash":"58642636936553668812422262972062789017"},"signature_version":"v1","target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-feda0935","source":"https://android.googlesource.com/platform/frameworks/base/+/9ddccd084b56e900ee4f6134976524aae8527ae1","digest":{"length":383,"function_hash":"295841275048368171116493633018900901982"},"signature_version":"v1","target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-380885270.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e0042507a584728e091655af00ff3f958a004d97"],"severity":"High","vanir_signatures":[{"signature_type":"Function","id":"ASB-A-380885270-87a2af5f","target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"digest":{"length":383,"function_hash":"295841275048368171116493633018900901982"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e0042507a584728e091655af00ff3f958a004d97","signature_version":"v1","deprecated":false},{"signature_type":"Line","id":"ASB-A-380885270-94a9c69d","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["52260370285639203235589360071749653018","328967283693661141864091776869430698938","189586162725560555251985529673111286599","196240744251274231338500046976963882883","236039801213343863761034186504008567160","117087061417595918025586080061858790204","94107306677305615451167231060175210696","110873781035025277549805130370678947934","155536508438028668751362241517294767956","48250072535440157564402516877884107078","146338139131755114960942265748568997680","138444153041219977876771276484544318192","246794235343814810740646112638158135300","127344443528582515039795652130552324568","316453581610428437326697987347551003280","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","7795229225593532171432182667904221605","223628502647132815961524499971318274078","209454432448306903235689052172987767869","278192999760310086927461722870914959805","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","16043719861345451608322868997224660696","291706465764554476319457593145407180363","239647385265092697034714632699843125226","266576849370593649080929628771659396745","229695016226321857641966657150699753045","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","143626308501198079237304467303923576933","335666883964392262919991900490441551701","69648412047852628610350404481839617819","289632595868881864486607811902758267751","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","22322805835170439058240275151559616767","63469913034047310311306701554525206213","153358400981321589894658350660472319107"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/e0042507a584728e091655af00ff3f958a004d97","target":{"file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-b30a7310","signature_version":"v1","digest":{"length":517,"function_hash":"289966756219251004989797386375447860513"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e0042507a584728e091655af00ff3f958a004d97","target":{"function":"shutdownIfNoPowerLocked","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-deb2865a","signature_version":"v1","digest":{"length":590,"function_hash":"193857023774587833305249268330514252802"},"target":{"function":"shutdownIfOverTempLocked","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e0042507a584728e091655af00ff3f958a004d97","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-ff0ed5c0","signature_version":"v1","digest":{"length":373,"function_hash":"58642636936553668812422262972062789017"},"target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e0042507a584728e091655af00ff3f958a004d97","deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-380885270.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e54ad764684a14b8a3f7387b6a73e36d93794443"],"severity":"High","vanir_signatures":[{"signature_type":"Line","id":"ASB-A-380885270-2aac6daf","target":{"file":"services/core/java/com/android/server/BatteryService.java"},"digest":{"threshold":0.9,"line_hashes":["215276886275111086371284207819325827502","186832046331287283256128854463343751944","329727225802409520488713404196203746892","5044607080903287581379435420235060798","236039801213343863761034186504008567160","117087061417595918025586080061858790204","94107306677305615451167231060175210696","110873781035025277549805130370678947934","155536508438028668751362241517294767956","48250072535440157564402516877884107078","146338139131755114960942265748568997680","138444153041219977876771276484544318192","246794235343814810740646112638158135300","127344443528582515039795652130552324568","316453581610428437326697987347551003280","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","7795229225593532171432182667904221605","223628502647132815961524499971318274078","209454432448306903235689052172987767869","278192999760310086927461722870914959805","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","16043719861345451608322868997224660696","291706465764554476319457593145407180363","239647385265092697034714632699843125226","266576849370593649080929628771659396745","229695016226321857641966657150699753045","79476747954611395811658749345833135134","238059697978005020064212375788910738939","156904296631268910102120309210071197266","111901730528633273751280233947583686117","143626308501198079237304467303923576933","335666883964392262919991900490441551701","69648412047852628610350404481839617819","289632595868881864486607811902758267751","221060105006334261594831755156430876566","45709152804438293341487881179301978558","79857656579781679713873665099933085318","244125084856819352952595829882912148068","22322805835170439058240275151559616767","63469913034047310311306701554525206213","153358400981321589894658350660472319107"]},"source":"https://android.googlesource.com/platform/frameworks/base/+/e54ad764684a14b8a3f7387b6a73e36d93794443","signature_version":"v1","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-35356607","source":"https://android.googlesource.com/platform/frameworks/base/+/e54ad764684a14b8a3f7387b6a73e36d93794443","digest":{"length":517,"function_hash":"289966756219251004989797386375447860513"},"signature_version":"v1","target":{"function":"shutdownIfNoPowerLocked","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-6f1c4baa","signature_version":"v1","digest":{"length":373,"function_hash":"58642636936553668812422262972062789017"},"target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e54ad764684a14b8a3f7387b6a73e36d93794443","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-71310c9d","signature_version":"v1","digest":{"length":590,"function_hash":"193857023774587833305249268330514252802"},"target":{"function":"shutdownIfOverTempLocked","file":"services/core/java/com/android/server/BatteryService.java"},"source":"https://android.googlesource.com/platform/frameworks/base/+/e54ad764684a14b8a3f7387b6a73e36d93794443","deprecated":false},{"signature_type":"Function","id":"ASB-A-380885270-c81c01e1","source":"https://android.googlesource.com/platform/frameworks/base/+/e54ad764684a14b8a3f7387b6a73e36d93794443","digest":{"length":383,"function_hash":"295841275048368171116493633018900901982"},"signature_version":"v1","target":{"function":"run","file":"services/core/java/com/android/server/BatteryService.java"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-380885270.json"}}],"schema_version":"1.7.5"}