{"id":"ASB-A-455563813","details":"In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-455563813","CVE-2025-48630"],"modified":"2026-04-16T15:14:46.093391Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/c81cf361489e3a3cd764c0a0c85c84958e25d63c"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/native/+/123f8fec995a3103acbc3a1191b9cef71523e013"],"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/123f8fec995a3103acbc3a1191b9cef71523e013","id":"ASB-A-455563813-4ef5b39d","target":{"file":"libs/renderengine/skia/SkiaRenderEngine.cpp"},"signature_version":"v1","digest":{"line_hashes":["70546619755174016530640091032185933299","322022721441228980600447337680645768198","258743177482309668911008057342498560399","296628683089105513291913234728952093682"],"threshold":0.9},"signature_type":"Line","deprecated":false}],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455563813.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/native/+/ee05b9b41f7579b8fdb18acf674bd86f9f7be2ab"],"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/ee05b9b41f7579b8fdb18acf674bd86f9f7be2ab","id":"ASB-A-455563813-d8b4acb6","target":{"file":"libs/renderengine/skia/SkiaRenderEngine.cpp"},"signature_version":"v1","digest":{"line_hashes":["70546619755174016530640091032185933299","322022721441228980600447337680645768198","258743177482309668911008057342498560399","128106498210777668547964176306361150633"],"threshold":0.9},"signature_type":"Line","deprecated":false}],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455563813.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/native/+/f3fecb02978030ae4066235cbe638250996b6a9a"],"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/f3fecb02978030ae4066235cbe638250996b6a9a","id":"ASB-A-455563813-1d89d11c","target":{"file":"libs/renderengine/skia/SkiaRenderEngine.cpp"},"signature_version":"v1","digest":{"line_hashes":["70546619755174016530640091032185933299","322022721441228980600447337680645768198","258743177482309668911008057342498560399","296628683089105513291913234728952093682"],"threshold":0.9},"signature_type":"Line","deprecated":false}],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455563813.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/native/+/6310a3ec793e67ab5768e4962a24429e5e6dafc6"],"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/6310a3ec793e67ab5768e4962a24429e5e6dafc6","id":"ASB-A-455563813-978eb36a","target":{"file":"libs/renderengine/skia/SkiaRenderEngine.cpp"},"signature_version":"v1","digest":{"line_hashes":["70546619755174016530640091032185933299","322022721441228980600447337680645768198","258743177482309668911008057342498560399","296628683089105513291913234728952093682"],"threshold":0.9},"signature_type":"Line","deprecated":false}],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455563813.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/frameworks/native/+/5bf5233b6caf121a7dff6d0dd4508a7ce6ba6950"],"types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/5bf5233b6caf121a7dff6d0dd4508a7ce6ba6950","id":"ASB-A-455563813-efb8d7a0","target":{"file":"libs/renderengine/skia/SkiaRenderEngine.cpp"},"signature_version":"v1","digest":{"line_hashes":["70546619755174016530640091032185933299","322022721441228980600447337680645768198","258743177482309668911008057342498560399","128106498210777668547964176306361150633"],"threshold":0.9},"signature_type":"Line","deprecated":false}],"spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455563813.json"}}],"schema_version":"1.7.5"}