{"id":"ASB-A-407991863","details":"In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-407991863","CVE-2025-48551"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/9810de0fcb5a104f5297671d654b8e0f2fba143c"}],"affected":[{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de"],"severity":"High","spl":"2025-09-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"13551692267448640322011329785694535553","length":1076},"id":"ASB-A-407991863-18e1fd2d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"createChooserActionFactory"}},{"source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"safelyStartActivityAsPersonalProfileUserWithSharedElementTransition"},"deprecated":false,"digest":{"function_hash":"323284697402033748502362556147759193773","length":233},"id":"ASB-A-407991863-2eab2a28","signature_type":"Function","signature_version":"v1"},{"target":{"file":"java/src/com/android/intentresolver/ChooserActionFactory.java"},"deprecated":false,"digest":{"line_hashes":["101867369588014950103656102534358821707","306317194483053207422188037157900621166","160704426539494366591003738758916495784","250505936468956827345688033794110805308","38110673141087757322453494509165873632","263020739624223882215767155794144171013","12581600653319617402095056905476819087","242675786657752986316363911326688576847","113598120556158122422212532223929533082","203376803130579902081891824873622264748","73278888427881404821125899453025325784","149291900467549066537035040469300260079","319777538284908730802494626434147733682"],"threshold":0.9},"id":"ASB-A-407991863-b1bc9c67","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"safelyStartActivityAsPersonalProfileUser"},"deprecated":false,"digest":{"function_hash":"240378617240652965689360248545942313658","length":194},"id":"ASB-A-407991863-caec7362","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"line_hashes":["191684362313041103910639584061440084609","101238107343338534671556334115778645243","312272753975339174460263663704996197702","316737928140337932985375736483104906698","51030993241440003271557109854314720193","148588984285673899417251448276044105628","267973568473889827732076559226717262849","266728393104373898561121824742978717708","272548406537954011371976724840357484752","273435684415834733979840313965185499811","16444793135684385830004128812814362401","113851401835958233725467456239499213966","247709104266419015309245606849544611230","196920599025561022912430987150445089516","254148657175062542047695876185173522672","262890387773751971460085399055530455991","249478260178805007681202637392626858775"],"threshold":0.9},"id":"ASB-A-407991863-fa8b3cd2","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407991863.json"}},{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"createChooserActionFactory"},"deprecated":false,"digest":{"function_hash":"302941098379555003077789850142935967202","length":1092},"id":"ASB-A-407991863-3071f14b","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac","target":{"file":"java/src/com/android/intentresolver/ChooserActionFactory.java"},"deprecated":false,"digest":{"line_hashes":["101867369588014950103656102534358821707","306317194483053207422188037157900621166","160704426539494366591003738758916495784","250505936468956827345688033794110805308","38110673141087757322453494509165873632","263020739624223882215767155794144171013","12581600653319617402095056905476819087","39171250668676078779636413394271869408","28407457052572686512380454671399400150","307006698909406281218548744980688865759","73278888427881404821125899453025325784","149291900467549066537035040469300260079","319777538284908730802494626434147733682"],"threshold":0.9},"id":"ASB-A-407991863-5d5b37a9","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"line_hashes":["191684362313041103910639584061440084609","101238107343338534671556334115778645243","312272753975339174460263663704996197702","316737928140337932985375736483104906698","51030993241440003271557109854314720193","148588984285673899417251448276044105628","267973568473889827732076559226717262849","266728393104373898561121824742978717708","272548406537954011371976724840357484752","273435684415834733979840313965185499811","16444793135684385830004128812814362401","113851401835958233725467456239499213966","247709104266419015309245606849544611230","196920599025561022912430987150445089516","254148657175062542047695876185173522672","262890387773751971460085399055530455991","249478260178805007681202637392626858775"],"threshold":0.9},"id":"ASB-A-407991863-69a75336","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"240378617240652965689360248545942313658","length":194},"id":"ASB-A-407991863-8e7b935f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"safelyStartActivityAsPersonalProfileUser"}},{"deprecated":false,"digest":{"length":233,"function_hash":"323284697402033748502362556147759193773"},"id":"ASB-A-407991863-cc5c6243","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac","target":{"function":"safelyStartActivityAsPersonalProfileUserWithSharedElementTransition","file":"java/src/com/android/intentresolver/ChooserActivity.java"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407991863.json"}},{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["ID"],"vanir_signatures":[{"target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"safelyStartActivityAsPersonalProfileUser"},"deprecated":false,"digest":{"length":194,"function_hash":"240378617240652965689360248545942313658"},"id":"ASB-A-407991863-08112b41","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d"},{"digest":{"function_hash":"13551692267448640322011329785694535553","length":1076},"id":"ASB-A-407991863-0b47bebd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d","target":{"function":"createChooserActionFactory","file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"line_hashes":["191684362313041103910639584061440084609","101238107343338534671556334115778645243","312272753975339174460263663704996197702","316737928140337932985375736483104906698","51030993241440003271557109854314720193","148588984285673899417251448276044105628","267973568473889827732076559226717262849","266728393104373898561121824742978717708","272548406537954011371976724840357484752","273435684415834733979840313965185499811","16444793135684385830004128812814362401","113851401835958233725467456239499213966","247709104266419015309245606849544611230","196920599025561022912430987150445089516","254148657175062542047695876185173522672","262890387773751971460085399055530455991","249478260178805007681202637392626858775"],"threshold":0.9},"id":"ASB-A-407991863-3bc1a894","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"323284697402033748502362556147759193773","length":233},"id":"ASB-A-407991863-b07972bb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d","target":{"function":"safelyStartActivityAsPersonalProfileUserWithSharedElementTransition","file":"java/src/com/android/intentresolver/ChooserActivity.java"}},{"digest":{"line_hashes":["101867369588014950103656102534358821707","306317194483053207422188037157900621166","160704426539494366591003738758916495784","250505936468956827345688033794110805308","38110673141087757322453494509165873632","263020739624223882215767155794144171013","12581600653319617402095056905476819087","242675786657752986316363911326688576847","113598120556158122422212532223929533082","203376803130579902081891824873622264748","73278888427881404821125899453025325784","149291900467549066537035040469300260079","319777538284908730802494626434147733682"],"threshold":0.9},"id":"ASB-A-407991863-e1648c1b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d","target":{"file":"java/src/com/android/intentresolver/ChooserActionFactory.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407991863.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":391,"function_hash":"45104543738673210472238066676239106515"},"id":"ASB-A-407991863-1d2cba59","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9b1ff63998d55df2d83b621936f208141fccd440","target":{"function":"createEditButton","file":"core/java/com/android/internal/app/ChooserActivity.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9b1ff63998d55df2d83b621936f208141fccd440"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407991863.json"}},{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2","target":{"function":"createChooserActionFactory","file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"function_hash":"225375004455393503844768829223253270480","length":981},"id":"ASB-A-407991863-3a491525","signature_type":"Function"},{"target":{"file":"java/src/com/android/intentresolver/ChooserActionFactory.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["306317194483053207422188037157900621166","160704426539494366591003738758916495784","250505936468956827345688033794110805308","38110673141087757322453494509165873632","263020739624223882215767155794144171013","12581600653319617402095056905476819087","221358284901460111307386848473599325514","91945753141763271557920024618697485775","96171429012762838835873678271290242922","73278888427881404821125899453025325784","149291900467549066537035040469300260079","319777538284908730802494626434147733682"]},"id":"ASB-A-407991863-4421371c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2"},{"id":"ASB-A-407991863-75f483f0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"safelyStartActivityAsPersonalProfileUserWithSharedElementTransition"},"deprecated":false,"digest":{"function_hash":"118513060201645892355221372295299131725","length":208}},{"deprecated":false,"digest":{"line_hashes":["266728393104373898561121824742978717708","272548406537954011371976724840357484752","273435684415834733979840313965185499811","16444793135684385830004128812814362401","113851401835958233725467456239499213966","236606869047989475060792167035641461756","163020257386826003367960892947713014593","298270253870408552887739644662143015772","93203456567668770104794014186121128499"],"threshold":0.9},"id":"ASB-A-407991863-919ec2d3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2"],"severity":"High","spl":"2025-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407991863.json"}},{"package":{"name":"platform/packages/modules/IntentResolver","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"safelyStartActivityAsPersonalProfileUserWithSharedElementTransition"},"deprecated":false,"digest":{"function_hash":"118513060201645892355221372295299131725","length":208},"id":"ASB-A-407991863-0365bafb"},{"id":"ASB-A-407991863-9cb49698","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5","target":{"file":"java/src/com/android/intentresolver/ChooserActionFactory.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81317462932937850074127772825786738745","306317194483053207422188037157900621166","160704426539494366591003738758916495784","250505936468956827345688033794110805308","38110673141087757322453494509165873632","263020739624223882215767155794144171013","12581600653319617402095056905476819087","221358284901460111307386848473599325514","91945753141763271557920024618697485775","96171429012762838835873678271290242922","73278888427881404821125899453025325784","149291900467549066537035040469300260079","319777538284908730802494626434147733682"]}},{"match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"safelyStartActivityAsPersonalProfileUser"},"deprecated":false,"digest":{"function_hash":"76915311157816807900452246902169939769","length":85},"id":"ASB-A-407991863-c4d811bb"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java","function":"createChooserActionFactory"},"deprecated":false,"digest":{"function_hash":"137758203882507555422735954598301607436","length":956},"id":"ASB-A-407991863-c6ba406a"},{"source":"https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5","target":{"file":"java/src/com/android/intentresolver/ChooserActivity.java"},"deprecated":false,"digest":{"line_hashes":["191684362313041103910639584061440084609","156649594227928834755303296606932545171","5082048086147984494691902163362061902","54305167445319589251627817046794153330","316911568431114403042689894604115283216","266728393104373898561121824742978717708","272548406537954011371976724840357484752","273435684415834733979840313965185499811","16444793135684385830004128812814362401","113851401835958233725467456239499213966","236606869047989475060792167035641461756","163020257386826003367960892947713014593","298270253870408552887739644662143015772","93203456567668770104794014186121128499"],"threshold":0.9},"id":"ASB-A-407991863-c7e716f7","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-407991863.json"}}],"schema_version":"1.9.0"}