What is the CVSS score of CVE-2025-48640?

CVE-2025-48640 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Android are affected by CVE-2025-48640?

CVE-2025-48640 in Google Android 17 enables nearby attackers with limited device access to bypass passkey (FIDO/WebAuthn) approval mechanisms and gain unauthorized credential access, exposing users…

How to fix or mitigate CVE-2025-48640?

Within 24 hours, inventory Android 17 deployments across the organization and identify systems using FIDO/WebAuthn credentials for authentication. Within 7 days, implement proximity-based controls such as restricting passkey credential additions to physically secured environments and enable audit logging for all passkey pairing events to detect anomalous attempts. Within 30 days, establish a testing plan in staging for the vendor security patch when released, and develop a deployment timeline prioritizing high-risk user populations and privileged accounts.

Android CVE-2025-48640

EUVD-2025-210215 HIGH

Missing Authorization (CWE-862)

2026-06-17 google_android

Authentication Bypass Privilege Escalation Google

8.0

CVSS 3.1 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Adjacent/proximal passkey pairing channel gives AV:A; a limited existing privilege is needed (PR:L) with no user interaction (UI:N), and full credential compromise yields C:H/I:H/A:H.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:32 vuln.today

CVE Published

Jun 17, 2026 - 05:53 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 17, 2026 - 05:53 cve.org

HIGH 8.0

DescriptionCVE.org

In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local/adjacent privilege escalation in Google Android 17 allows a nearby attacker to gain approval for a third-party passkey (FIDO/WebAuthn credential) pairing entry because a required permission check is missing across multiple code paths. Because the flaw sits in the passkey pairing-approval logic and needs no user interaction, an attacker within proximal/adjacent range holding limited privileges can escalate to full credential access. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.13%, 3rd percentile).

Technical ContextAI

The vulnerability is a CWE-862 (Missing Authorization) weakness in Android's passkey subsystem. Passkeys are FIDO2/WebAuthn discoverable credentials that replace passwords; on Android they can be provisioned and paired across devices/entries, and pairing an entry is meant to be gated by an authorization/permission check that verifies the requesting party is entitled to bind that credential. In multiple locations that check is absent, so a third party can have a passkey entry pairing approved without proper consent. The affected component is the Android platform itself (CPE cpe:2.3:a:google:android), fixed via the Android Security Bulletin. The 'adjacent' attack vector (AV:A) indicates the abuse occurs over a proximal channel such as Bluetooth/hybrid-transport (caBLE) or local-network pairing used for cross-device passkey flows, rather than over the open internet.

RemediationAI

Apply the Google-provided fix from the Android Security Bulletin (https://source.android.com/docs/security/bulletin/android-17) by updating to the security patch level that resolves CVE-2025-48640; on managed fleets, push the OTA/monthly security update and enforce the patched security patch level via MDM. An exact standalone fix version beyond 'Android 17 bulletin patch level' is not independently confirmed from the input, so treat the bulletin's designated patch level as the authoritative version. Because the attack requires proximity, effective compensating controls until patching include disabling or restricting cross-device passkey/hybrid (caBLE) pairing and Bluetooth on sensitive devices (trade-off: breaks legitimate cross-device passkey sign-in and nearby-device features), keeping high-value devices out of untrusted radio proximity, and requiring device unlock/user confirmation for any credential pairing where configurable. Reference: https://vuldb.com/vuln/371835.