EUVD-2025-210016
GHSA-rh6r-gg6r-2qxc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser installs malicious app
-
DeliveryApp runs with normal low privileges
-
ExploitTrigger permission-reset bypass in framework
-
ExecutionPermission state altered without prompt
-
ImpactAbuse newly-held permissions to exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | The attacker must already have code execution on the device as an installed Android application (CVSS AV:L with PR:L), meaning a malicious or compromised app - sideloaded, distributed via a poisoned Play listing, or chained from a prior RCE - must be present and running on Android 14, 15, 16, or 16-qpr2. No user interaction is required once the app is installed (UI:N), and no additional execution privileges are needed beyond those any third-party app obtains by default. Limiting factors: the bug is not remotely reachable over the network, devices on the June 2026 or later security patch level are not affected, and managed devices that block sideloading and rely on Play Protect reduce (but do not remove) the delivery surface. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a locally-exploitable flaw with low attack complexity, low privileges, no user interaction, and high impact across confidentiality, integrity, and availability - consistent with a malicious app on the device elevating its effective permissions without prompting the user. EPSS is extremely low at 0.01% (1st percentile) and the CVE is not on CISA KEV, which together suggest no observed mass exploitation; however, EPSS models internet-facing exploitation poorly and tends to under-weight on-device Android bugs, so the low score should not be treated as evidence the bug is benign. There is no conflict in the data, but one limitation worth flagging: the description says 'multiple locations' without naming the specific subsystems, so defenders cannot tell from public data whether this is a single root-cause fix or a sweep across several components - verification against the June 2026 Android Security Bulletin is needed. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app (game, utility, wallpaper) from a sideloaded source or a marginal Play listing; the app holds only the low-privilege permissions the user originally granted, or none at all. Leveraging the permission-reset bypass, the app silently rolls back or alters permission state in one of the affected code paths, ending up with elevated access to sensitive APIs (location, SMS, microphone, storage) that the user never approved. No public exploit identified at time of analysis, but the bug pattern is well within reach of motivated mobile malware authors once the bulletin details are studied. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android versions 14, 15, 16, and 16-qpr2 allows a malicious app to reset user-selected permission choices by bypassing the permission enforcement logic (CWE-693, Protection Mechanism Failure). The flaw requires no user interaction and only low privileges already available to any installed app, but at present there is no public exploit identified at time of analysis and EPSS rates real-world exploitation probability at just 0.01%.
RemediationAI
Apply the patch published in the Android Security Bulletin dated 2026-06-01 (https://source.android.com/docs/security/bulletin/2026/2026-06-01); patch available per vendor advisory, with the fix delivered through the standard monthly security patch level on Pixel and through OEM updates for third-party devices. On managed fleets, enforce a minimum SecurityPatchLevel via MDM (Android Enterprise's setRequiredPasswordComplexity / device compliance policies) so devices below the June 2026 patch level lose access to corporate resources; the trade-off is user friction on OEMs slow to ship patches. Until devices are patched, restrict sideloading by disabling 'Install unknown apps' for all sources and require apps to come from Google Play or a vetted enterprise store, since exploitation requires a malicious app already running on the device - this reduces but does not eliminate risk because Play-distributed apps have historically carried malware. Consider Google Play Protect being enabled (default on GMS devices) as a partial compensating control while patches roll out.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Android's runtime permission model is the security boundary that gates access to sensitive APIs such as location, microphone, camera, contacts, and storage. CWE-693 (Protection Mechanism Failure) indicates the bug is not a memory corruption or logic crash but a failure of the permission enforcement layer itself: the platform's permission state, which is supposed to reflect what the user explicitly granted or denied, can be reset across multiple code paths because the checks that should guard those resets are absent or circumventable. The affected component, identified via CPE cpe:2.3:a:google:android:*, is the platform itself (AOSP framework / PermissionController) rather than a single OEM build, which means downstream device vendors all inherit the issue until they pick up the June 2026 Android Security Bulletin patch.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android versions 14, 15, 16, and 16-qpr2 contain a local privilege escalation vulnerability (CVE-2025-48649, CVSS 7.8) allowing any installed application to bypass permission controls and reset user-selected security settings. While no public exploit has been identified and exploitation probability is minimal (EPSS 0.0%), the flaw poses meaningful risk to organizations with Android device deployments, as compromised applications could elevate privileges undetected.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce app installation from Google Play Store only via MDM or device policies; (2) Disable installation from unknown sources at the device policy level; (3) Deploy app allowlist policies (whitelist-based controls) to restrict applications to pre-approved list; (4) Restrict or suspend BYOD programs until patches are available, or require enhanced security baselines and app vetting for personal devices; (5) Implement alerting for anomalous permission escalation events and suspicious app behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB