{"id":"ASB-A-401545800","details":"In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-401545800","CVE-2025-48563"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/dee86220f445f19c87762dfd508f8d7f4f97bd9d"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/d883efa912c0a39c46437074576cffb7078ac455","target":{"file":"services/autofill/java/com/android/server/autofill/RemoteFillService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["211598700065759576457031615535262198756","155749383717225277394767495477347620741","326208054660854204827188902700841952735"]},"id":"ASB-A-401545800-54e1a5a5","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d883efa912c0a39c46437074576cffb7078ac455"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401545800.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0cbc42f4dc6b3763532176b67141aac0c8a400d7","target":{"file":"services/autofill/java/com/android/server/autofill/RemoteFillService.java"},"deprecated":false,"digest":{"line_hashes":["211598700065759576457031615535262198756","155749383717225277394767495477347620741","326208054660854204827188902700841952735"],"threshold":0.9},"id":"ASB-A-401545800-4b720817"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0cbc42f4dc6b3763532176b67141aac0c8a400d7"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401545800.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/857a29c6a368906a7502be5caaa910ef61dcb54c","target":{"file":"services/autofill/java/com/android/server/autofill/RemoteFillService.java"},"deprecated":false,"digest":{"line_hashes":["211598700065759576457031615535262198756","155749383717225277394767495477347620741","326208054660854204827188902700841952735"],"threshold":0.9},"id":"ASB-A-401545800-7fbf8d20"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/857a29c6a368906a7502be5caaa910ef61dcb54c"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401545800.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-401545800-bb9fd62e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2f90ae5465282498eed99a4dcaddb4494e69743b","target":{"file":"services/autofill/java/com/android/server/autofill/RemoteFillService.java"},"deprecated":false,"digest":{"line_hashes":["211598700065759576457031615535262198756","155749383717225277394767495477347620741","326208054660854204827188902700841952735"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2f90ae5465282498eed99a4dcaddb4494e69743b"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401545800.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/cd1b8b60cd9b58a221ac06b2483ca7d49c2f1787","target":{"file":"services/autofill/java/com/android/server/autofill/RemoteFillService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["211598700065759576457031615535262198756","155749383717225277394767495477347620741","326208054660854204827188902700841952735"]},"id":"ASB-A-401545800-69ef838c","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/cd1b8b60cd9b58a221ac06b2483ca7d49c2f1787"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-401545800.json"}}],"schema_version":"1.9.0"}