CVE-2025-48565: 
NixOS vulnerability analysis and mitigation

CVE-2025-48565 is a privilege escalation vulnerability in Android's cross-profile intent filter mechanism caused by a logic error in the code. It affects Android versions 13.0, 14.0, 15.0, and 16.0. The flaw allows a local attacker to bypass cross-profile intent filters and escalate privileges without requiring additional execution privileges or user interaction. It carries a CVSS v3.1 base score of 7.8 (High) and was disclosed via the Google Android Security Bulletin dated December 1, 2025 (Android Bulletin).

The vulnerability (CWE classification: logic error) resides in multiple locations within Android's cross-profile intent filter handling code, specifically in the frameworks/base and packages/modules/IntentResolver components. A logic error allows a locally-executing application to craft intents that bypass the cross-profile intent filter restrictions, which are designed to prevent apps in one profile (e.g., work profile) from interacting with components in another (e.g., personal profile). The attack vector is local, requires only low privileges, and no user interaction, making it straightforward to exploit once an attacker has a foothold on the device. Patches were committed to the Android Open Source Project (AOSP) repositories (Android Bulletin, AOSP Patch 1, AOSP Patch 2).

Successful exploitation allows a local attacker to escalate privileges on affected Android devices, potentially gaining unauthorized access to sensitive data across profile boundaries (e.g., between work and personal profiles), modifying system integrity, and disrupting system availability. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker could read sensitive cross-profile data, tamper with system components, or cause service disruption. This is particularly significant in enterprise environments where Android work profiles are used to segregate corporate and personal data (Android Bulletin).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-48565. The EPSS score is approximately 0.007%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Android Bulletin).

Google has released patches for this vulnerability as part of the December 2025 Android Security Bulletin (patch level 2025-12-01). Users and administrators should apply the December 2025 security update to all Android devices running versions 13.0 through 16.0. No configuration-based workaround is publicly documented; upgrading to the patched security patch level is the recommended remediation. Enterprise administrators should verify that managed Android devices have received the update and enforce minimum security patch level policies (Android Bulletin).

The vulnerability was covered in the context of Google's December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. Coverage appeared on security news outlets and community blogs, noting the breadth of the December patch cycle. Samsung also incorporated the patch into its December 2025 security update for Galaxy devices (SammyFans). No notable individual researcher commentary or significant social media discussion specific to CVE-2025-48565 has been identified.