{"id":"ASB-A-388029380","details":"In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-388029380","CVE-2025-48546"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/3668e1d4bbecf4491a6a1fc3ba3271ac836996b6"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"length":4841,"function_hash":"88478523765484669656114339466300631800"},"id":"ASB-A-388029380-96593781","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/79a2129ba784f44010010ef64c5699bc02b9d694","target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java","function":"checkPermissions"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["18683652401544354204102093389011998865","277875387310819017280268639258201420312","182901939001019561222504191169804761632","22789413629838014960704001128916706499","52118393659685150272506684898325522991","57215168243626478314369970335843580015","281441035965316854095665042298814110057"]},"id":"ASB-A-388029380-e2e313c8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/79a2129ba784f44010010ef64c5699bc02b9d694"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/79a2129ba784f44010010ef64c5699bc02b9d694"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388029380.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/88496615b1c72503b557184c4df2973a757b764d","target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["18683652401544354204102093389011998865","277875387310819017280268639258201420312","182901939001019561222504191169804761632","22789413629838014960704001128916706499","52118393659685150272506684898325522991","57215168243626478314369970335843580015","281441035965316854095665042298814110057"]},"id":"ASB-A-388029380-196778c4"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/88496615b1c72503b557184c4df2973a757b764d","target":{"function":"checkPermissions","file":"services/core/java/com/android/server/wm/SafeActivityOptions.java"},"deprecated":false,"digest":{"function_hash":"282259069491063418232180432855722884154","length":4670},"id":"ASB-A-388029380-f10604be"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/88496615b1c72503b557184c4df2973a757b764d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388029380.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["18683652401544354204102093389011998865","277875387310819017280268639258201420312","182901939001019561222504191169804761632","22789413629838014960704001128916706499","52118393659685150272506684898325522991","57215168243626478314369970335843580015","281441035965316854095665042298814110057"],"threshold":0.9},"id":"ASB-A-388029380-9216a46e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b49d5d4d03dd0965e8aa0a438898213435d0bca1","target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b49d5d4d03dd0965e8aa0a438898213435d0bca1","target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java","function":"checkPermissions"},"deprecated":false,"digest":{"function_hash":"334479579187023279453892612676184042590","length":4793},"id":"ASB-A-388029380-e7d0c598","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b49d5d4d03dd0965e8aa0a438898213435d0bca1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388029380.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-388029380-01b13e98","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/169ec7518f74bd4b691949ece59509e73777dfcf","target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["18683652401544354204102093389011998865","277875387310819017280268639258201420312","182901939001019561222504191169804761632","22789413629838014960704001128916706499","52118393659685150272506684898325522991","57215168243626478314369970335843580015","281441035965316854095665042298814110057"]}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/169ec7518f74bd4b691949ece59509e73777dfcf","target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java","function":"checkPermissions"},"deprecated":false,"digest":{"function_hash":"138172804207808648907055078747056982990","length":3498},"id":"ASB-A-388029380-7b7e92b4","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/169ec7518f74bd4b691949ece59509e73777dfcf"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388029380.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java"},"deprecated":false,"digest":{"line_hashes":["18683652401544354204102093389011998865","277875387310819017280268639258201420312","182901939001019561222504191169804761632","22789413629838014960704001128916706499","52118393659685150272506684898325522991","57215168243626478314369970335843580015","281441035965316854095665042298814110057"],"threshold":0.9},"id":"ASB-A-388029380-33586cb7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5b9e64572e2168bb7f37566e93caa86cc1a474fe"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/5b9e64572e2168bb7f37566e93caa86cc1a474fe","target":{"file":"services/core/java/com/android/server/wm/SafeActivityOptions.java","function":"checkPermissions"},"deprecated":false,"digest":{"function_hash":"193021278701427925362307439324909849198","length":5069},"id":"ASB-A-388029380-994f0451","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/5b9e64572e2168bb7f37566e93caa86cc1a474fe"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-388029380.json"}}],"schema_version":"1.9.0"}