{"id":"ASB-A-385736540","details":"In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-385736540","CVE-2025-48572"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"send"},"deprecated":false,"digest":{"function_hash":"316370734914974112922512838681362559473","length":1860},"id":"ASB-A-385736540-0f871ef5","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0","target":{"function":"dispatchMediaKeyEventLocked","file":"services/core/java/com/android/server/media/MediaSessionService.java"},"deprecated":false,"digest":{"length":1976,"function_hash":"186126368883898822795091504787417490532"},"id":"ASB-A-385736540-12089638"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["339810405352632085719091451311321674095","275975107146969956370038515730504573102","80497620183686386007736524282487791566","62418201323741799120306728308834156764","55865714173573915107216148403219505114","7648070471863515924186944870300117845","7795994052236267357960140086620066571","140715571409977858173753011776446487337","160791381214626622993839315322313461248","285823131317625649400454352761529686792","152489777678090466548466303667684018243","86157283484121117596203212179130565755","236661106157293379370043909333147044200","139494860666073456306352422804323662980","227089099119759810086834679082268080347","123925540056839143095672710156009698173","6758001863816488574372644869670397233","306937530902221669713689707599239301886","155655847639340755093639206222904693932","131606800696986250182282483148701001115","109373831995261988836437559702546324171","99917887084937512107958716423542590166","311037115874089012015679734201465496793","159119449463397141804386937033147939174","95387817101797232990380013837505315666","258037821717334382848300956764489571534","2061100622956081909542890173591037927","80181970134694028826649465051793635105","336648108446277117073573073154593819018","165572617918622412845323166496542590532"]},"id":"ASB-A-385736540-44d31c3c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0","target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java"},"deprecated":false,"digest":{"line_hashes":["248725520175376610014865440393759759092","255221898688515736745163158731756297001","66919101396382129865736464723074217672","276533932626755003608503706335412412506","19460016803938391979888974122455004298","199356742234517526349997163450580743818","272313623517751408320150890528715246371","122229009202774695296209935430158122724","83600479556083361139501506086919843774","78026168801566047364994799468759064195"],"threshold":0.9},"id":"ASB-A-385736540-ad788b76","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-385736540.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"send"},"deprecated":false,"digest":{"function_hash":"316370734914974112922512838681362559473","length":1860},"id":"ASB-A-385736540-0ddfc859","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e","target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java","function":"dispatchMediaKeyEventLocked"},"deprecated":false,"digest":{"function_hash":"186126368883898822795091504787417490532","length":1976},"id":"ASB-A-385736540-8828627f","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e","target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java"},"deprecated":false,"digest":{"line_hashes":["248725520175376610014865440393759759092","255221898688515736745163158731756297001","66919101396382129865736464723074217672","276533932626755003608503706335412412506","19460016803938391979888974122455004298","199356742234517526349997163450580743818","272313623517751408320150890528715246371","122229009202774695296209935430158122724","83600479556083361139501506086919843774","78026168801566047364994799468759064195"],"threshold":0.9},"id":"ASB-A-385736540-e5dc91e7","signature_type":"Line"},{"id":"ASB-A-385736540-ff6e203b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["275975107146969956370038515730504573102","80497620183686386007736524282487791566","62418201323741799120306728308834156764","55865714173573915107216148403219505114","7648070471863515924186944870300117845","7795994052236267357960140086620066571","140715571409977858173753011776446487337","160791381214626622993839315322313461248","285823131317625649400454352761529686792","152489777678090466548466303667684018243","86157283484121117596203212179130565755","236661106157293379370043909333147044200","139494860666073456306352422804323662980","227089099119759810086834679082268080347","123925540056839143095672710156009698173","109373831995261988836437559702546324171","99917887084937512107958716423542590166","311037115874089012015679734201465496793","159119449463397141804386937033147939174","95387817101797232990380013837505315666","258037821717334382848300956764489571534","2061100622956081909542890173591037927","80181970134694028826649465051793635105","336648108446277117073573073154593819018","165572617918622412845323166496542590532"]}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-385736540.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-385736540-82654da4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba","target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java"},"deprecated":false,"digest":{"line_hashes":["248725520175376610014865440393759759092","255221898688515736745163158731756297001","66919101396382129865736464723074217672","276533932626755003608503706335412412506","19460016803938391979888974122455004298","199356742234517526349997163450580743818","272313623517751408320150890528715246371","122229009202774695296209935430158122724","83600479556083361139501506086919843774","78026168801566047364994799468759064195"],"threshold":0.9}},{"digest":{"function_hash":"186126368883898822795091504787417490532","length":1976},"id":"ASB-A-385736540-852a8203","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba","target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java","function":"dispatchMediaKeyEventLocked"},"deprecated":false},{"target":{"function":"send","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"function_hash":"316370734914974112922512838681362559473","length":1860},"id":"ASB-A-385736540-9c14fd83","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba"},{"target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"line_hashes":["275975107146969956370038515730504573102","80497620183686386007736524282487791566","62418201323741799120306728308834156764","55865714173573915107216148403219505114","7648070471863515924186944870300117845","7795994052236267357960140086620066571","140715571409977858173753011776446487337","160791381214626622993839315322313461248","285823131317625649400454352761529686792","152489777678090466548466303667684018243","86157283484121117596203212179130565755","236661106157293379370043909333147044200","139494860666073456306352422804323662980","227089099119759810086834679082268080347","123925540056839143095672710156009698173","109373831995261988836437559702546324171","99917887084937512107958716423542590166","311037115874089012015679734201465496793","159119449463397141804386937033147939174","95387817101797232990380013837505315666","258037821717334382848300956764489571534","2061100622956081909542890173591037927","80181970134694028826649465051793635105","336648108446277117073573073154593819018","165572617918622412845323166496542590532"],"threshold":0.9},"id":"ASB-A-385736540-c9f981fd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-385736540.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java","function":"dispatchMediaKeyEventLocked"},"deprecated":false,"digest":{"length":1976,"function_hash":"186126368883898822795091504787417490532"},"id":"ASB-A-385736540-17f3fbe8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["275975107146969956370038515730504573102","80497620183686386007736524282487791566","62418201323741799120306728308834156764","55865714173573915107216148403219505114","7648070471863515924186944870300117845","7795994052236267357960140086620066571","140715571409977858173753011776446487337","160791381214626622993839315322313461248","285823131317625649400454352761529686792","152489777678090466548466303667684018243","86157283484121117596203212179130565755","236661106157293379370043909333147044200","139494860666073456306352422804323662980","227089099119759810086834679082268080347","123925540056839143095672710156009698173","109373831995261988836437559702546324171","99917887084937512107958716423542590166","311037115874089012015679734201465496793","159119449463397141804386937033147939174","95387817101797232990380013837505315666","258037821717334382848300956764489571534","2061100622956081909542890173591037927","80181970134694028826649465051793635105","336648108446277117073573073154593819018","165572617918622412845323166496542590532"]},"id":"ASB-A-385736540-4cea93b6","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["248725520175376610014865440393759759092","255221898688515736745163158731756297001","66919101396382129865736464723074217672","276533932626755003608503706335412412506","19460016803938391979888974122455004298","199356742234517526349997163450580743818","272313623517751408320150890528715246371","122229009202774695296209935430158122724","83600479556083361139501506086919843774","78026168801566047364994799468759064195"],"threshold":0.9},"id":"ASB-A-385736540-812bb4a9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0","target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0","target":{"function":"send","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"function_hash":"316370734914974112922512838681362559473","length":1860},"id":"ASB-A-385736540-aa2cf3cf","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-385736540.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"send"},"deprecated":false,"digest":{"function_hash":"316370734914974112922512838681362559473","length":1860},"id":"ASB-A-385736540-061888ea","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"186126368883898822795091504787417490532","length":1976},"id":"ASB-A-385736540-09103ec2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0","target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java","function":"dispatchMediaKeyEventLocked"}},{"digest":{"line_hashes":["275975107146969956370038515730504573102","80497620183686386007736524282487791566","62418201323741799120306728308834156764","55865714173573915107216148403219505114","7648070471863515924186944870300117845","7795994052236267357960140086620066571","140715571409977858173753011776446487337","160791381214626622993839315322313461248","285823131317625649400454352761529686792","152489777678090466548466303667684018243","86157283484121117596203212179130565755","236661106157293379370043909333147044200","139494860666073456306352422804323662980","227089099119759810086834679082268080347","123925540056839143095672710156009698173","109373831995261988836437559702546324171","99917887084937512107958716423542590166","311037115874089012015679734201465496793","159119449463397141804386937033147939174","95387817101797232990380013837505315666","258037821717334382848300956764489571534","2061100622956081909542890173591037927","80181970134694028826649465051793635105","336648108446277117073573073154593819018","165572617918622412845323166496542590532"],"threshold":0.9},"id":"ASB-A-385736540-218a1d72","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/media/MediaSessionService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["248725520175376610014865440393759759092","255221898688515736745163158731756297001","66919101396382129865736464723074217672","276533932626755003608503706335412412506","19460016803938391979888974122455004298","199356742234517526349997163450580743818","272313623517751408320150890528715246371","122229009202774695296209935430158122724","83600479556083361139501506086919843774","78026168801566047364994799468759064195"]},"id":"ASB-A-385736540-87a76863","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-385736540.json"}}],"schema_version":"1.9.0"}