{"id":"ASB-A-442392902","details":"In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-442392902","CVE-2025-48654"],"modified":"2026-09-18T16:02:27.100044548Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/924df83d73d9f938fde025c2e793ca12646207e0"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"length":394,"function_hash":"143785000613672222614623615866495066150"},"id":"ASB-A-442392902-89b760ad","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4ba87708d35798cf9cf940eb0d0e0c44ee80ff90","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java","function":"onUserUnlocked"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["286720284354167371042258582396272771686","213032033685877894840004614563863634943","70027145459842236628249982916387204256","303884910693667180125040863696892927503","166274897630632840372375057142802799333","176031409827260308855681749070344590274","69994410509437792301668060115930290455","221118992569095008543530470926278945827","321421430269904280349814185003705085428","130953099298294595615642391303072259967"],"threshold":0.9},"id":"ASB-A-442392902-ad346ef4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4ba87708d35798cf9cf940eb0d0e0c44ee80ff90","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"}},{"digest":{"function_hash":"48021427173488384795938876113131833975","length":410},"id":"ASB-A-442392902-bee73529","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4ba87708d35798cf9cf940eb0d0e0c44ee80ff90","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java","function":"onStart"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/975dab1f72d08a4444cb07c8bd7206ae95f2e65c","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false,"digest":{"line_hashes":["100773564642563799443363088126167028264","337625126975700278524523411866481193415","68463754524088633172381643215059855522","194173072776936318033832449965978497353","99636806959312342506754886445120011592","309306652100673762866566535910597669584","16881537851996141394921705504896483707"],"threshold":0.9},"id":"ASB-A-442392902-cb8227b6"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/975dab1f72d08a4444cb07c8bd7206ae95f2e65c","https://android.googlesource.com/platform/frameworks/base/+/4ba87708d35798cf9cf940eb0d0e0c44ee80ff90"],"severity":"High","spl":"2026-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-442392902.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false,"digest":{"line_hashes":["100773564642563799443363088126167028264","337625126975700278524523411866481193415","68463754524088633172381643215059855522","19561236882564109537809807217987058052","99636806959312342506754886445120011592","309306652100673762866566535910597669584","16881537851996141394921705504896483707"],"threshold":0.9},"id":"ASB-A-442392902-38f3cc73","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/13714bcfaff6ef1c16d0aa3d359b1c8bc1859ac3"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c0db0fbeded02a17497a4e5b41dcbc3585fece9","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java","function":"onStart"},"deprecated":false,"digest":{"length":410,"function_hash":"48021427173488384795938876113131833975"},"id":"ASB-A-442392902-657777fa","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c0db0fbeded02a17497a4e5b41dcbc3585fece9","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java","function":"onUserUnlocked"},"deprecated":false,"digest":{"function_hash":"281838199007528695170471352152093345857","length":168},"id":"ASB-A-442392902-7456a974","match_only_versions":["16"]},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1c0db0fbeded02a17497a4e5b41dcbc3585fece9","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false,"digest":{"line_hashes":["286720284354167371042258582396272771686","213032033685877894840004614563863634943","70027145459842236628249982916387204256","274330499571565592312542382951288584868","333519443708892071570584893164584316243","184861558791978087236915185456503162456","80203359528076787491911315837724127152","113164008307219510650290889289954460171","234089391209023368796356861878539292229","126181518158334775349269975007089989970"],"threshold":0.9},"id":"ASB-A-442392902-a4f2aba2"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/13714bcfaff6ef1c16d0aa3d359b1c8bc1859ac3","https://android.googlesource.com/platform/frameworks/base/+/1c0db0fbeded02a17497a4e5b41dcbc3585fece9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-442392902.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-442392902-a121fc01","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9ed0f9fb6a6400704744988ed11dd0f2b290f656","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java","function":"onStart"},"deprecated":false,"digest":{"function_hash":"48021427173488384795938876113131833975","length":410}},{"digest":{"line_hashes":["286720284354167371042258582396272771686","213032033685877894840004614563863634943","70027145459842236628249982916387204256","274330499571565592312542382951288584868","333519443708892071570584893164584316243","184861558791978087236915185456503162456","80203359528076787491911315837724127152","113164008307219510650290889289954460171","185561202963924680835468596800710025404","260142052063178296041300893326504257769"],"threshold":0.9},"id":"ASB-A-442392902-b6207e5f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9ed0f9fb6a6400704744988ed11dd0f2b290f656","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false},{"digest":{"line_hashes":["100773564642563799443363088126167028264","337625126975700278524523411866481193415","68463754524088633172381643215059855522","19561236882564109537809807217987058052","99636806959312342506754886445120011592","309306652100673762866566535910597669584","16881537851996141394921705504896483707"],"threshold":0.9},"id":"ASB-A-442392902-c1d38471","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/665bab82f9b4dfe9afe9d9c0010f076ff154f936","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java"},"deprecated":false},{"digest":{"function_hash":"130455999052051922629691337464722594426","length":300},"id":"ASB-A-442392902-ef7f7fe8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9ed0f9fb6a6400704744988ed11dd0f2b290f656","target":{"file":"services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java","function":"onUserUnlocked"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/665bab82f9b4dfe9afe9d9c0010f076ff154f936","https://android.googlesource.com/platform/frameworks/base/+/9ed0f9fb6a6400704744988ed11dd0f2b290f656"],"severity":"High","spl":"2026-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-442392902.json"}}],"schema_version":"1.9.0"}