CVE-2025-48535: 
NixOS vulnerability analysis and mitigation

CVE-2025-48535 is a local privilege escalation vulnerability discovered in Android's AppRestrictionsFragment.java component, specifically in the assertSafeToStartCustomActivity function. The vulnerability was disclosed on September 4, 2025, affecting multiple versions of the Android operating system including Android 13.0, 14.0, 15.0, and 16.0 (NVD).

The vulnerability stems from a parcel mismatch in the assertSafeToStartCustomActivity function of AppRestrictionsFragment.java, which can be exploited through unsafe deserialization. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) (AttackerKB).

The successful exploitation of this vulnerability could lead to local privilege escalation on affected Android devices. The impact is rated as high across all three security metrics - Confidentiality, Integrity, and Availability, with no user interaction required for exploitation (NVD).

Google has released security patches for this vulnerability as part of the September 2025 Android Security Bulletin. Users of affected Android versions (13.0-16.0) are advised to update their devices to the latest security patch level. The fix involves modifying the Intent handling in the AppRestrictionsFragment.java file (Android Bulletin).