{"id":"ASB-A-452042097","details":"In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-452042097","CVE-2025-48652"],"modified":"2026-06-23T15:45:40.410020820Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/4dc009cd724cc1cac5202737a36fd99a36817fef"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/a37dfe713785cf6668e37b2db51ddd0117d000fd"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"High","types":["EoP"],"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/81f83fdb0944d0d8a3337d2578d73dd77d60143b","https://android.googlesource.com/platform/frameworks/base/+/3a8cafbc916bb16f08093cd138a4f3d4dc71b5a0"],"vanir_signatures":[{"deprecated":false,"signature_version":"v1","signature_type":"Function","id":"ASB-A-452042097-2768598b","source":"https://android.googlesource.com/platform/frameworks/base/+/81f83fdb0944d0d8a3337d2578d73dd77d60143b","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"length":5212,"function_hash":"250422163576007906311266012289777872182"}},{"deprecated":false,"signature_type":"Function","signature_version":"v1","id":"ASB-A-452042097-33d4d5e6","source":"https://android.googlesource.com/platform/frameworks/base/+/3a8cafbc916bb16f08093cd138a4f3d4dc71b5a0","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"length":5368,"function_hash":"100030477261424655126180009970891241346"}},{"deprecated":false,"signature_version":"v1","signature_type":"Line","id":"ASB-A-452042097-55c52e00","source":"https://android.googlesource.com/platform/frameworks/base/+/3a8cafbc916bb16f08093cd138a4f3d4dc71b5a0","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"line_hashes":["287132440164127787900311066968192799727","164519494202683672545617179320789003357","138171701637261579886780142808251429156","118950082544996558241270151258894954790","205962933611596569598905475197057681318","339212848590255868881735291014739566110","86108500175382950414919141294367363625","156764555094095553428736879062392066565","191532771678698477672970247084537738412","255581199148193568627533287425454229027","290675925820840181720862084669207068026","55677350880354714741032176669907204269","71184792004730734152824800369152777495","255767029212197698652256852376734350990","207698343155878492333116002183090507131","68481736996391822122261320336070972728","212135947151508281235870612616797972870","127273446773051425750538227936562897688","47370117806126140198103485369132863627"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-452042097.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-06-01","types":["EoP"],"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/base/+/9d20d0ae8fef770df8788e287feee1bdaa1d82fe","https://android.googlesource.com/platform/frameworks/base/+/2037b1942fa03b2bcef1a594391a9066843e12b9"],"vanir_signatures":[{"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"ASB-A-452042097-14ec3c63","source":"https://android.googlesource.com/platform/frameworks/base/+/2037b1942fa03b2bcef1a594391a9066843e12b9","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"line_hashes":["337914855583033950000470837460687568703","323225291477559724252769863747976871550","12993850030047719886337886213116709527","69218230836534493503370581312937399404","211131758483743502972810153806039891018","55706111860254569511876067929323968701","15453643987758595554831692251290408253","287467501295358791479963012926649940917","205962933611596569598905475197057681318","339212848590255868881735291014739566110","86108500175382950414919141294367363625","156764555094095553428736879062392066565","191532771678698477672970247084537738412","255581199148193568627533287425454229027","290675925820840181720862084669207068026","55677350880354714741032176669907204269","71184792004730734152824800369152777495","255767029212197698652256852376734350990","207698343155878492333116002183090507131","68481736996391822122261320336070972728","212135947151508281235870612616797972870","127273446773051425750538227936562897688","47370117806126140198103485369132863627"],"threshold":0.9}},{"deprecated":false,"signature_type":"Function","signature_version":"v1","id":"ASB-A-452042097-6d8dcdeb","source":"https://android.googlesource.com/platform/frameworks/base/+/2037b1942fa03b2bcef1a594391a9066843e12b9","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"length":4878,"function_hash":"94295996917709442584824378661522274239"}},{"deprecated":false,"signature_type":"Function","signature_version":"v1","id":"ASB-A-452042097-87a15bf4","source":"https://android.googlesource.com/platform/frameworks/base/+/9d20d0ae8fef770df8788e287feee1bdaa1d82fe","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"length":4689,"function_hash":"287453740526710581950574342339092744209"}},{"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"ASB-A-452042097-b40482c0","source":"https://android.googlesource.com/platform/frameworks/base/+/9d20d0ae8fef770df8788e287feee1bdaa1d82fe","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"line_hashes":["328548339366017752016247469880555865525","71368936658131001356163451329700918830","238712992803264733650657741741603873037","137322820868736966531532931221043606766","243762482219670487913519775635378928871","199978472912560643564452394414264356089","190232638976956763741150218767635461710","156070560232633049248674495065622431630","21234215190283236317895917982949994798","339251475197397614607041173548238204571","140080411196817140487499909367994882185","41417576202939934957899041741923888323","93706148092658107260797983135435416517"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-452042097.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","types":["EoP"],"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/6e0b7c02e54a0c8f26ecb2eefd136677df7decfc","https://android.googlesource.com/platform/frameworks/base/+/9aec06e22b59a74f7bc90d285eee3a52963c6a91"],"vanir_signatures":[{"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"ASB-A-452042097-2ec0fc1a","source":"https://android.googlesource.com/platform/frameworks/base/+/9aec06e22b59a74f7bc90d285eee3a52963c6a91","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"line_hashes":["337914855583033950000470837460687568703","323225291477559724252769863747976871550","12993850030047719886337886213116709527","69218230836534493503370581312937399404","211131758483743502972810153806039891018","55706111860254569511876067929323968701","15453643987758595554831692251290408253","287467501295358791479963012926649940917","205962933611596569598905475197057681318","339212848590255868881735291014739566110","86108500175382950414919141294367363625","156764555094095553428736879062392066565","191532771678698477672970247084537738412","255581199148193568627533287425454229027","290675925820840181720862084669207068026","55677350880354714741032176669907204269","71184792004730734152824800369152777495","255767029212197698652256852376734350990","207698343155878492333116002183090507131","68481736996391822122261320336070972728","212135947151508281235870612616797972870","127273446773051425750538227936562897688","47370117806126140198103485369132863627"],"threshold":0.9}},{"deprecated":false,"signature_type":"Function","signature_version":"v1","id":"ASB-A-452042097-4b7d3266","source":"https://android.googlesource.com/platform/frameworks/base/+/6e0b7c02e54a0c8f26ecb2eefd136677df7decfc","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"length":4781,"function_hash":"97780827404223550033223079363767928414"}},{"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"ASB-A-452042097-b6fd1b5b","source":"https://android.googlesource.com/platform/frameworks/base/+/6e0b7c02e54a0c8f26ecb2eefd136677df7decfc","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"line_hashes":["328548339366017752016247469880555865525","71368936658131001356163451329700918830","238712992803264733650657741741603873037","137322820868736966531532931221043606766","243762482219670487913519775635378928871","199978472912560643564452394414264356089","190232638976956763741150218767635461710","156070560232633049248674495065622431630","21234215190283236317895917982949994798","339251475197397614607041173548238204571","140080411196817140487499909367994882185","41417576202939934957899041741923888323","93706148092658107260797983135435416517"],"threshold":0.9}},{"deprecated":false,"digest":{"length":4970,"function_hash":"338345737930857674648825227169806103949"},"signature_version":"v1","id":"ASB-A-452042097-eadf6ee6","source":"https://android.googlesource.com/platform/frameworks/base/+/9aec06e22b59a74f7bc90d285eee3a52963c6a91","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-452042097.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","types":["EoP"],"spl":"2026-06-01","fixes":["https://android.googlesource.com/platform/frameworks/base/+/982f43f3bbdb55751913fa6752051df639a5e719","https://android.googlesource.com/platform/frameworks/base/+/59d1cf64718bacec47b2a0c5138473fb0708a007"],"vanir_signatures":[{"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"ASB-A-452042097-19910e38","source":"https://android.googlesource.com/platform/frameworks/base/+/59d1cf64718bacec47b2a0c5138473fb0708a007","target":{"file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"line_hashes":["287132440164127787900311066968192799727","164519494202683672545617179320789003357","138171701637261579886780142808251429156","118950082544996558241270151258894954790","205962933611596569598905475197057681318","339212848590255868881735291014739566110","86108500175382950414919141294367363625","156764555094095553428736879062392066565","191532771678698477672970247084537738412","255581199148193568627533287425454229027","290675925820840181720862084669207068026","55677350880354714741032176669907204269","71184792004730734152824800369152777495","255767029212197698652256852376734350990","207698343155878492333116002183090507131","68481736996391822122261320336070972728","212135947151508281235870612616797972870","127273446773051425750538227936562897688","47370117806126140198103485369132863627"],"threshold":0.9}},{"deprecated":false,"signature_type":"Function","signature_version":"v1","id":"ASB-A-452042097-6826f139","source":"https://android.googlesource.com/platform/frameworks/base/+/982f43f3bbdb55751913fa6752051df639a5e719","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"digest":{"length":5212,"function_hash":"250422163576007906311266012289777872182"}},{"deprecated":false,"digest":{"length":5368,"function_hash":"100030477261424655126180009970891241346"},"signature_version":"v1","id":"ASB-A-452042097-7471a56b","source":"https://android.googlesource.com/platform/frameworks/base/+/59d1cf64718bacec47b2a0c5138473fb0708a007","target":{"function":"onCreate","file":"packages/PackageInstaller/src/com/android/packageinstaller/InstallStart.java"},"signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-452042097.json"}}],"schema_version":"1.7.5"}