What is the CVSS score of CVE-2025-48646?

CVE-2025-48646 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2025-48646?

Android devices running versions up to 14.0 are vulnerable to local privilege escalation attacks that require no special permissions, potentially allowing attackers to gain full device control.

How to fix or mitigate CVE-2025-48646?

Within 24 hours: Inventory all Android devices running versions 14.0 and below across the organization and assess exposure. Within 7 days: Communicate risk to device users and restrict sensitive operations on vulnerable devices until mitigation is deployed; escalate vendor patching timeline with device manufacturers. Within 30 days: Deploy mobile device management (MDM) controls to enforce maximum OS versions and enforce mandatory OS updates; prepare incident response procedures for compromised Android devices.

Android CVE-2025-48646

HIGH

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-03-02 security@android.com

Privilege Escalation Google Android

7.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 19:16 nvd

HIGH 7.8

DescriptionNVD

In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

AnalysisAI

Android versions up to 14.0 contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 7.8).

Technical ContextAI

affects Android. In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.