CVE-2025-48574: 
NixOS vulnerability analysis and mitigation

CVE-2025-48574 is a missing permission check vulnerability in Android's DisplayPolicy.java (validateAddingWindowLw) that allows a local unprivileged application to intercept drag-and-drop events and escalate its privileges. It affects Android versions 14.0, 15.0, and 16.0. The vulnerability was published on March 2, 2026, and addressed in the Android Security Bulletin 2026-03-01. It carries a CVSS v3.1 base score of 8.4 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is a missing authorization check (CWE-862) in the validateAddingWindowLw method of DisplayPolicy.java, a component responsible for managing window policy on Android. Because the permission check is absent, any installed application — regardless of its declared permissions — can register a window overlay that intercepts drag-and-drop events originating from other applications. The attack vector is local (AV:L), requires no privileges (PR:N), and no user interaction (UI:N), making exploitation straightforward for any app installed on the device (Android Security Bulletin, Red Hat CVE).

Successful exploitation allows a malicious local application to intercept drag-and-drop data exchanged between other applications, enabling local escalation of privilege with high impact to confidentiality, integrity, and availability. An attacker could capture sensitive data (e.g., credentials, files) transferred via drag-and-drop, and the elevated privilege context could facilitate further compromise of the device. The scope is limited to the affected device (S:U), but the combination of high CIA impact scores makes this a significant risk for multi-user or enterprise Android deployments (Android Security Bulletin).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is extremely low at 0.00002, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Install malicious app: An attacker distributes a malicious Android application (via sideloading or a third-party store) that does not require any special permissions.
2. Register intercepting window: The app calls Android window management APIs to add a window overlay, exploiting the missing permission check in validateAddingWindowLw of DisplayPolicy.java to register without the normally required authorization.
3. Intercept drag-and-drop events: When the device user performs a drag-and-drop action between legitimate applications (e.g., dragging a file or text), the malicious overlay window receives the drag event data intended for the target application.
4. Exfiltrate or abuse captured data: The attacker's app reads the intercepted drag-and-drop payload (which may include files, text, credentials, or other sensitive content) and exfiltrates it or uses it to escalate privileges further on the device (Android Security Bulletin).

• Logs: Android system logs (logcat) showing unexpected window additions from unprivileged applications via DisplayPolicy or WindowManagerService without corresponding permission grants.
• Process/App Behavior: Applications with no declared overlay or system alert window permissions that nonetheless appear in window layer listings; apps exhibiting unusual drag event listener registrations.
• Network: Unexpected outbound data transfers from applications that have no legitimate reason to send data, potentially following user drag-and-drop interactions.

Google released a patch in the Android Security Bulletin for the 2026-03-01 patch level, addressing Android versions 14.0, 15.0, and 16.0. Device owners and administrators should apply the March 2026 security update (patch level 2026-03-01 or later) as soon as it is available from their device manufacturer. No configuration-based workaround has been published; patching is the only recommended remediation. Samsung and Huawei have also released corresponding updates for their devices (Android Security Bulletin, CIS Advisory).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in the March 2026 Android update, including CVE-2025-48574, warning of potential privilege escalation risks (CIS Advisory). Samsung and Huawei both incorporated the patch into their respective March and June 2026 security updates. No significant independent researcher commentary or social media discussion has been identified beyond routine vulnerability tracking.