{"id":"ASB-A-419105158","details":"In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-419105158","CVE-2025-48547"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Permission/+/78fc913decb391bbe8d0ac234e9713dfce90b905"}],"affected":[{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java"},"deprecated":false,"digest":{"line_hashes":["74825677860359291823974794769304984176","54322402409406010169508596696786023303","149235292749647675855049937282637692328","145013895052549469505389721590657500791","265767361724839045342447047174574977562","102710347970585637851489659692902243550","275567820779311389591207760822014200503","243068526678371013366756144344111722117","326924609749117370276583456477135782063","91797170069577512876250884230120803431","322495709066598504498068707578859914980","284551813374187850879305258932787529686","35581522152420388306072435625144289782","124705026470328882745707010837683270003","38324757769072650307223109268881316104","307343563236157825046198801932332425013"],"threshold":0.9},"id":"ASB-A-419105158-09863809","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/2b7a2c80f69a80163d35f45b5300d400884945a0"},{"digest":{"function_hash":"260088681823930295452555195420737221986","length":3222},"id":"ASB-A-419105158-3a004c64","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/2b7a2c80f69a80163d35f45b5300d400884945a0","target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java","function":"persistChanges"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/2b7a2c80f69a80163d35f45b5300d400884945a0"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-419105158.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/ec041faffbce834da5f0991633aa5f590facc570","target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java","function":"persistChanges"},"deprecated":false,"digest":{"function_hash":"260088681823930295452555195420737221986","length":3222},"id":"ASB-A-419105158-50ad2761","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["74825677860359291823974794769304984176","54322402409406010169508596696786023303","149235292749647675855049937282637692328","145013895052549469505389721590657500791","265767361724839045342447047174574977562","102710347970585637851489659692902243550","275567820779311389591207760822014200503","243068526678371013366756144344111722117","326924609749117370276583456477135782063","91797170069577512876250884230120803431","322495709066598504498068707578859914980","284551813374187850879305258932787529686","35581522152420388306072435625144289782","124705026470328882745707010837683270003","38324757769072650307223109268881316104","307343563236157825046198801932332425013"],"threshold":0.9},"id":"ASB-A-419105158-c2929b4e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/ec041faffbce834da5f0991633aa5f590facc570","target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/ec041faffbce834da5f0991633aa5f590facc570"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-419105158.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/4cb2bd6b493cc651590c12f75626e9cee90124a8"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["74825677860359291823974794769304984176","54322402409406010169508596696786023303","149235292749647675855049937282637692328","145013895052549469505389721590657500791","265767361724839045342447047174574977562","102710347970585637851489659692902243550","275567820779311389591207760822014200503","243068526678371013366756144344111722117","326924609749117370276583456477135782063","91797170069577512876250884230120803431","322495709066598504498068707578859914980","284551813374187850879305258932787529686","35581522152420388306072435625144289782","124705026470328882745707010837683270003","38324757769072650307223109268881316104","307343563236157825046198801932332425013"],"threshold":0.9},"id":"ASB-A-419105158-21f1050e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/4cb2bd6b493cc651590c12f75626e9cee90124a8","target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/4cb2bd6b493cc651590c12f75626e9cee90124a8","target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java","function":"persistChanges"},"deprecated":false,"digest":{"function_hash":"260088681823930295452555195420737221986","length":3222},"id":"ASB-A-419105158-50e12d9e","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-419105158.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-419105158-20a49674","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/26cc8f2998be530779a3a3e80e88ef553248fe33","target":{"function":"persistChanges","file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java"},"deprecated":false,"digest":{"function_hash":"220668117331389215027334985350153136971","length":3032}},{"source":"https://android.googlesource.com/platform/packages/modules/Permission/+/26cc8f2998be530779a3a3e80e88ef553248fe33","target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java"},"deprecated":false,"digest":{"line_hashes":["74825677860359291823974794769304984176","54322402409406010169508596696786023303","267548239275556959447862350785613098248","50027076109527570550056316263034239680","73188563377188574666708103529591744602","243068526678371013366756144344111722117","326924609749117370276583456477135782063","91797170069577512876250884230120803431","322495709066598504498068707578859914980","284551813374187850879305258932787529686","35581522152420388306072435625144289782","124705026470328882745707010837683270003","38324757769072650307223109268881316104","307343563236157825046198801932332425013"],"threshold":0.9},"id":"ASB-A-419105158-50ee2cbf","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/26cc8f2998be530779a3a3e80e88ef553248fe33"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-419105158.json"}},{"package":{"name":"platform/packages/modules/Permission","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-419105158-384d9fb3","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/302388a02a5869b8df40164ef35489c704622a9e","target":{"file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["74825677860359291823974794769304984176","54322402409406010169508596696786023303","149235292749647675855049937282637692328","145013895052549469505389721590657500791","265767361724839045342447047174574977562","102710347970585637851489659692902243550","275567820779311389591207760822014200503","243068526678371013366756144344111722117","326924609749117370276583456477135782063","91797170069577512876250884230120803431","322495709066598504498068707578859914980","284551813374187850879305258932787529686","35581522152420388306072435625144289782","124705026470328882745707010837683270003","38324757769072650307223109268881316104","307343563236157825046198801932332425013"]}},{"deprecated":false,"digest":{"length":3222,"function_hash":"260088681823930295452555195420737221986"},"id":"ASB-A-419105158-6512b576","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Permission/+/302388a02a5869b8df40164ef35489c704622a9e","target":{"function":"persistChanges","file":"PermissionController/src/com/android/permissioncontroller/permission/model/AppPermissionGroup.java"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Permission/+/302388a02a5869b8df40164ef35489c704622a9e"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-419105158.json"}}],"schema_version":"1.9.0"}