{"id":"ASB-A-404254549","details":"In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-404254549","CVE-2025-48618"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/fee68bcdcf029e8f40980616d09367610544bc62"}],"affected":[{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/dcf5c112a93dc8fcc67d65434707e205fd79cee2","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java"},"deprecated":false,"digest":{"line_hashes":["126841584836587469014955577698167293997","168254648683542555738692921111058362169","93597993831312728335032933858035332714","201576147938869780718846071442591858311","296332964556440632912533357557336683078","102447935041989546204727891996243023724","56155387748275661933978624091286924453","336818962558103374523242084094841889704","46632421777451632340080436636403098793","247717101312116447828082806340619679576","283109049979985087688153187750762351747","204400155171772489866802819424636014856","180631327578771327964947079217621243298","255581152413201755700612624712317165337"],"threshold":0.9},"id":"ASB-A-404254549-0d3740be","signature_type":"Line"},{"digest":{"function_hash":"40406192771755523414762501391771993671","length":465},"id":"ASB-A-404254549-14f747d5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/dcf5c112a93dc8fcc67d65434707e205fd79cee2","target":{"file":"src/java/com/android/internal/telephony/cat/ResultException.java","function":"ResultException"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/dcf5c112a93dc8fcc67d65434707e205fd79cee2","target":{"file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"line_hashes":["117668481257297107530764335499844443242","327268473740061505278911752601663297328","300373037912090030938662428104802295310","177996292300046045383743207326557855174","23056403281171326616536705075062193914","247143444613494069882996688514518247832","65775505213269645513353343758759787473"],"threshold":0.9},"id":"ASB-A-404254549-162288c5"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/dcf5c112a93dc8fcc67d65434707e205fd79cee2","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"CommandParamsFactory"},"deprecated":false,"digest":{"function_hash":"283287314837110726171987907853411129386","length":519},"id":"ASB-A-404254549-4ef6c021","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/dcf5c112a93dc8fcc67d65434707e205fd79cee2","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"processLaunchBrowser"},"deprecated":false,"digest":{"function_hash":"245255220764803643324960432761250446283","length":1345},"id":"ASB-A-404254549-8d32e9ff","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/dcf5c112a93dc8fcc67d65434707e205fd79cee2"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-404254549.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/928df99dd7389e24e953101766b0810e7e526555"],"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"283287314837110726171987907853411129386","length":519},"id":"ASB-A-404254549-0b916b4e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/928df99dd7389e24e953101766b0810e7e526555","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"CommandParamsFactory"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"40406192771755523414762501391771993671","length":465},"id":"ASB-A-404254549-1fe05b01","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/928df99dd7389e24e953101766b0810e7e526555","target":{"function":"ResultException","file":"src/java/com/android/internal/telephony/cat/ResultException.java"}},{"deprecated":false,"digest":{"line_hashes":["192332858909354083000301575240343213579","168254648683542555738692921111058362169","93597993831312728335032933858035332714","201576147938869780718846071442591858311","296332964556440632912533357557336683078","102447935041989546204727891996243023724","56155387748275661933978624091286924453","336818962558103374523242084094841889704","46632421777451632340080436636403098793","247717101312116447828082806340619679576","283109049979985087688153187750762351747","204400155171772489866802819424636014856","180631327578771327964947079217621243298","255581152413201755700612624712317165337"],"threshold":0.9},"id":"ASB-A-404254549-88c74f6f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/928df99dd7389e24e953101766b0810e7e526555","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/928df99dd7389e24e953101766b0810e7e526555","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"processLaunchBrowser"},"deprecated":false,"digest":{"length":1345,"function_hash":"245255220764803643324960432761250446283"},"id":"ASB-A-404254549-91f59a45"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/928df99dd7389e24e953101766b0810e7e526555","target":{"file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["117668481257297107530764335499844443242","327268473740061505278911752601663297328","300373037912090030938662428104802295310","177996292300046045383743207326557855174","23056403281171326616536705075062193914","247143444613494069882996688514518247832","65775505213269645513353343758759787473"]},"id":"ASB-A-404254549-ec96ef30","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-404254549.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d3774ac65a38121b242f75388a08971883cc05d2","target":{"file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"line_hashes":["117668481257297107530764335499844443242","327268473740061505278911752601663297328","300373037912090030938662428104802295310","177996292300046045383743207326557855174","23056403281171326616536705075062193914","247143444613494069882996688514518247832","65775505213269645513353343758759787473"],"threshold":0.9},"id":"ASB-A-404254549-0dbb476c"},{"id":"ASB-A-404254549-2b038a87","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d3774ac65a38121b242f75388a08971883cc05d2","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java"},"deprecated":false,"digest":{"line_hashes":["192332858909354083000301575240343213579","168254648683542555738692921111058362169","93597993831312728335032933858035332714","201576147938869780718846071442591858311","296332964556440632912533357557336683078","102447935041989546204727891996243023724","56155387748275661933978624091286924453","336818962558103374523242084094841889704","46632421777451632340080436636403098793","247717101312116447828082806340619679576","283109049979985087688153187750762351747","204400155171772489866802819424636014856","180631327578771327964947079217621243298","255581152413201755700612624712317165337"],"threshold":0.9}},{"id":"ASB-A-404254549-4aa23628","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d3774ac65a38121b242f75388a08971883cc05d2","target":{"function":"ResultException","file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"length":465,"function_hash":"40406192771755523414762501391771993671"}},{"id":"ASB-A-404254549-62cc75a9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d3774ac65a38121b242f75388a08971883cc05d2","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"CommandParamsFactory"},"deprecated":false,"digest":{"function_hash":"283287314837110726171987907853411129386","length":519}},{"id":"ASB-A-404254549-ea060c27","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d3774ac65a38121b242f75388a08971883cc05d2","target":{"function":"processLaunchBrowser","file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java"},"deprecated":false,"digest":{"length":1345,"function_hash":"245255220764803643324960432761250446283"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/d3774ac65a38121b242f75388a08971883cc05d2"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-404254549.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/12ae4849fad33bc6b1d145428d8c547a5912199e","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"processLaunchBrowser"},"deprecated":false,"digest":{"function_hash":"245255220764803643324960432761250446283","length":1345},"id":"ASB-A-404254549-1de1addb"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/12ae4849fad33bc6b1d145428d8c547a5912199e","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"CommandParamsFactory"},"deprecated":false,"digest":{"function_hash":"57267232105146911331819391053436561220","length":313},"id":"ASB-A-404254549-25a174ab","signature_type":"Function"},{"id":"ASB-A-404254549-6804c41c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/12ae4849fad33bc6b1d145428d8c547a5912199e","target":{"file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"line_hashes":["117668481257297107530764335499844443242","327268473740061505278911752601663297328","300373037912090030938662428104802295310","177996292300046045383743207326557855174","23056403281171326616536705075062193914","247143444613494069882996688514518247832","65775505213269645513353343758759787473"],"threshold":0.9}},{"target":{"function":"ResultException","file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"length":465,"function_hash":"40406192771755523414762501391771993671"},"id":"ASB-A-404254549-6e4d3337","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/12ae4849fad33bc6b1d145428d8c547a5912199e"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/12ae4849fad33bc6b1d145428d8c547a5912199e","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192332858909354083000301575240343213579","168254648683542555738692921111058362169","93597993831312728335032933858035332714","132661127246613407098264706443338888972","249290390951984909688795074319993036822","178787134647457598986328236406502151650","336818962558103374523242084094841889704","46632421777451632340080436636403098793","247717101312116447828082806340619679576","283109049979985087688153187750762351747","204400155171772489866802819424636014856","180631327578771327964947079217621243298","255581152413201755700612624712317165337"]},"id":"ASB-A-404254549-eff53b60"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/12ae4849fad33bc6b1d145428d8c547a5912199e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-404254549.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["192332858909354083000301575240343213579","168254648683542555738692921111058362169","93597993831312728335032933858035332714","187403188051938735880290827081193559597","47296757770091565774755302790624994189","182948830206079551311604649551017378172","336818962558103374523242084094841889704","46632421777451632340080436636403098793","247717101312116447828082806340619679576","283109049979985087688153187750762351747","204400155171772489866802819424636014856","180631327578771327964947079217621243298","255581152413201755700612624712317165337"],"threshold":0.9},"id":"ASB-A-404254549-4b6506a7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ddafa596ceef0e0866db0a17d49c5fd4470467b8","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java"}},{"target":{"file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"line_hashes":["117668481257297107530764335499844443242","327268473740061505278911752601663297328","300373037912090030938662428104802295310","177996292300046045383743207326557855174","23056403281171326616536705075062193914","247143444613494069882996688514518247832","65775505213269645513353343758759787473"],"threshold":0.9},"id":"ASB-A-404254549-51dd3548","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ddafa596ceef0e0866db0a17d49c5fd4470467b8"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ddafa596ceef0e0866db0a17d49c5fd4470467b8","target":{"function":"ResultException","file":"src/java/com/android/internal/telephony/cat/ResultException.java"},"deprecated":false,"digest":{"length":465,"function_hash":"40406192771755523414762501391771993671"},"id":"ASB-A-404254549-5209685d"},{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ddafa596ceef0e0866db0a17d49c5fd4470467b8","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"processLaunchBrowser"},"deprecated":false,"digest":{"length":1345,"function_hash":"245255220764803643324960432761250446283"},"id":"ASB-A-404254549-5b6e1254","signature_type":"Function","signature_version":"v1"},{"digest":{"length":519,"function_hash":"283287314837110726171987907853411129386"},"id":"ASB-A-404254549-e418e3b6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/ddafa596ceef0e0866db0a17d49c5fd4470467b8","target":{"file":"src/java/com/android/internal/telephony/cat/CommandParamsFactory.java","function":"CommandParamsFactory"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/ddafa596ceef0e0866db0a17d49c5fd4470467b8"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-404254549.json"}}],"schema_version":"1.9.0"}