CVE-2025-48573: 
NixOS vulnerability analysis and mitigation

CVE-2025-48573 is a local privilege escalation vulnerability in Android's MediaSessionRecord.java that allows a background application to launch a foreground service by abusing the Foreground Service (FGS) while-in-use mechanism. It affects Android versions 13.0, 14.0, 15.0, and 16.0. The vulnerability was disclosed on December 8, 2025, with a patch included in Google's December 2025 Android Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin).

The root cause lies in the sendCommand method of MediaSessionRecord.java, where insufficient enforcement of FGS while-in-use restrictions allows a background app to improperly launch a foreground service (CWE-250: Execution with Unnecessary Privileges). An attacker with a locally installed, low-privileged application can exploit this flaw without requiring additional execution privileges or any user interaction. The attack vector is local, with low attack complexity, making it straightforward to exploit once an attacker has a foothold on the device. A patch commit is publicly available on the Android Open Source Project (AOSP) repository (AOSP Patch, Android Security Bulletin).

Successful exploitation enables a locally installed malicious application to escalate its privileges by launching foreground services outside of normal Android restrictions, potentially gaining elevated access to system resources. This could allow an attacker to compromise system integrity, manipulate service availability, and potentially access or modify sensitive data on the device. The impact spans confidentiality, integrity, and availability — all rated High — across Android 13 through 16 (Android Security Bulletin).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Android Security Bulletin). The EPSS score is extremely low at 0.000050, reflecting minimal current exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported at this time.

Google has released a patch as part of the December 2025 Android Security Bulletin (patch level 2025-12-01). Users and administrators should apply the latest Android security update immediately to all affected devices running Android 13, 14, 15, or 16. As interim measures, organizations should monitor system logs for unusual foreground service activity and enforce strict application permission controls. The AOSP patch is available at the referenced commit (Android Security Bulletin, AOSP Patch).

The vulnerability received coverage in the context of Google's December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. Samsung's security update for October 2025 was noted in community discussions, and GrapheneOS released a corresponding update. Security aggregators such as BeyondMachines and Hawk-Eye noted the bulletin's breadth, though CVE-2025-48573 itself did not generate significant standalone commentary (Android Security Bulletin).