{"id":"ASB-A-407764858","details":"In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-407764858","CVE-2025-48526"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/247af9e3e487aabb03d7aad79f71e9f78571d142"}],"affected":[{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e","target":{"function":"initialize","file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"length":5642,"function_hash":"162876921944084724772787647666407605162"},"id":"ASB-A-407764858-7914f45d"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"recreatePagerAdapter"},"deprecated":false,"digest":{"length":1983,"function_hash":"245014903818687579480104451141464789506"},"id":"ASB-A-407764858-b46bc1ec","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"createMultiProfilePagerAdapter"},"deprecated":false,"digest":{"length":1040,"function_hash":"269489128610763341285638470587810319166"},"id":"ASB-A-407764858-d636f719","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["215333141439614203753758609164174502322","92686852643144425174299857766869900904","185571118409943467701918122230630182350","299328347200442535910218016921829993374","215333141439614203753758609164174502322","92686852643144425174299857766869900904","263737943769798527988401749923504940804","83731266336373756401423512545034306967","131568089663822273778780646859032046846","228286212397013514343482128007987050757","293605670750163784902857303051406727315","107495251614009311720607524365834370070","173754968742481079859037967833701907271","259764565464088187677568724754000298186","9995448754546046436225691572829368258","166514408147717829439730404577729472986","108778651122802310635196509103581479526","27242652280024949580262926206255132154","309496245061920905911472417094546533046","240184056093340782984785804047562560688","88769382919936861286729784349501338228","83485324021357080616177964679131411457","319173807185048622048758937182457274688","36615385033742190461066328375264598620"]},"id":"ASB-A-407764858-ee17de06","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/d605b5448615815cb6a7630637b9c55349ffe36e"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"}},{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-407764858-18b03e0f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"recreatePagerAdapter"},"deprecated":false,"digest":{"length":1551,"function_hash":"47385744904952644988629242753947747582"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"line_hashes":["159320662772587594802989918164026606043","249952864840277843374201996634089409644","185571118409943467701918122230630182350","299328347200442535910218016921829993374","159320662772587594802989918164026606043","249952864840277843374201996634089409644","263737943769798527988401749923504940804","83731266336373756401423512545034306967","188384057836139474750289453774664245777","173417142359944964570386983870238641061","293605670750163784902857303051406727315","107495251614009311720607524365834370070","173754968742481079859037967833701907271","259764565464088187677568724754000298186","9995448754546046436225691572829368258","129862893307899221670768442190490512679","12242478898106145515416046652646761632","82305941197215487350735843313308597617","287623922150154831874068837120182263581","3949598570500360823143437329026834701","119056791189994695887283639616722706116","88769382919936861286729784349501338228","83485324021357080616177964679131411457","319173807185048622048758937182457274688","36615385033742190461066328375264598620"],"threshold":0.9},"id":"ASB-A-407764858-32c28f4e"},{"deprecated":false,"digest":{"function_hash":"277441329241121412496619467039944055635","length":5193},"id":"ASB-A-407764858-9f98d4a4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe","target":{"function":"initialize","file":"java/src/com/android/intentresolver/ChooserActivity.java"}},{"source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"createMultiProfilePagerAdapter"},"deprecated":false,"digest":{"function_hash":"329672116372703837246512655755336984446","length":1144},"id":"ASB-A-407764858-de22d897","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/8b7fe6ad71472d4cb3d00321f840fbebe4b2bbbe"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"}},{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"createMultiProfilePagerAdapter"},"deprecated":false,"digest":{"function_hash":"269489128610763341285638470587810319166","length":1040},"id":"ASB-A-407764858-0622c816","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01"},{"digest":{"line_hashes":["215333141439614203753758609164174502322","92686852643144425174299857766869900904","185571118409943467701918122230630182350","299328347200442535910218016921829993374","215333141439614203753758609164174502322","92686852643144425174299857766869900904","263737943769798527988401749923504940804","83731266336373756401423512545034306967","131568089663822273778780646859032046846","228286212397013514343482128007987050757","293605670750163784902857303051406727315","107495251614009311720607524365834370070","173754968742481079859037967833701907271","259764565464088187677568724754000298186","9995448754546046436225691572829368258","166514408147717829439730404577729472986","108778651122802310635196509103581479526","27242652280024949580262926206255132154","309496245061920905911472417094546533046","240184056093340782984785804047562560688","88769382919936861286729784349501338228","83485324021357080616177964679131411457","319173807185048622048758937182457274688","36615385033742190461066328375264598620"],"threshold":0.9},"id":"ASB-A-407764858-0ddde6c3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01","target":{"function":"initialize","file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"function_hash":"26306566549522124209316819212510561251","length":5027},"id":"ASB-A-407764858-d50d9f8d","signature_type":"Function","signature_version":"v1"},{"target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"recreatePagerAdapter"},"deprecated":false,"digest":{"length":1999,"function_hash":"141190872899214642077379963305813886430"},"id":"ASB-A-407764858-e4c86595","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/b3d03bd65fce1c582be2bdf20c35e426496dcf01"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/07f1d8bda4dee82ec3f6e9ee387ec9c58648f2a6","target":{"function":"createChooserMultiProfilePagerAdapterForTwoProfiles","file":"core/java/com/android/internal/app/ChooserActivity.java"},"deprecated":false,"digest":{"function_hash":"154719132187196818922568902695499015179","length":439},"id":"ASB-A-407764858-83acb509","signature_type":"Function","signature_version":"v1"},{"target":{"file":"core/java/com/android/internal/app/ChooserActivity.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["303200336292687948470798038711625385160","312116394965678215848163713502176217651","150956291927727367153030701760209362946","56988950160021802968717575176214961445","208226744332229224564731370192207040976","21016183867967356869875992074226210646","233072465952685026719431423238787540268","58317128744481872808735684339114521534","117577704333210749895440127921391488041","54716239563214829348819313860819299706","192971077688858538798706176302956457198","220618106892077315522619458348290676690","265098355571209063931064720029194008857","79792159623743412109835793969545414772","294433187559997815648810400875250291234","249826123069047202027451074380779988875"]},"id":"ASB-A-407764858-a74b1332","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/07f1d8bda4dee82ec3f6e9ee387ec9c58648f2a6"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/07f1d8bda4dee82ec3f6e9ee387ec9c58648f2a6"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"}},{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["241690411752982290529145353848693069971","93667484321929739672812455931140241550","248332587967891437381698483150003949526","263679993672820044546197025256300575960","233916810246275409202968732652250779959","219612390083847085112809178634900296948","56988950160021802968717575176214961445","208226744332229224564731370192207040976","21016183867967356869875992074226210646","233072465952685026719431423238787540268","148452800304778791217052167309346886950","220618106892077315522619458348290676690","265098355571209063931064720029194008857","79792159623743412109835793969545414772"],"threshold":0.9},"id":"ASB-A-407764858-f597198b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e94664d31320aeef70d25218f51d89418b965e1e","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e94664d31320aeef70d25218f51d89418b965e1e","target":{"function":"createChooserMultiProfilePagerAdapterForTwoProfiles","file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"length":518,"function_hash":"35145605575209271686893571447086542240"},"id":"ASB-A-407764858-fb9affdd","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e94664d31320aeef70d25218f51d89418b965e1e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407764858.json"}}],"schema_version":"1.9.0"}