CVE-2025-48588: 
NixOS vulnerability analysis and mitigation

CVE-2025-48588 is a logic error vulnerability in the startAlwaysOnVpn function of Vpn.java in Android that allows a low-privileged local attacker to disable always-on VPN protection, leading to local escalation of privilege. It affects Android versions 13.0, 14.0, and 15.0. The vulnerability was disclosed on December 8, 2025, as part of the December 2025 Android Security Bulletin, with a patch dated December 1, 2025. It carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin).

The root cause is a logic error (CWE-840) in the startAlwaysOnVpn method within Vpn.java in the Android framework (platform/frameworks/base). An attacker with low-privilege local access can exploit this flaw to manipulate the always-on VPN state, effectively disabling it without requiring elevated permissions or user interaction. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (UI:N), making it straightforward to exploit for any unprivileged app or user on the device. A patch commit is available in the Android Open Source Project (AOSP) repository (Android Security Bulletin, AOSP Commit).

Successful exploitation allows a low-privileged attacker to disable always-on VPN protection on the affected Android device, bypassing network security controls and potentially exposing all device network traffic to interception or man-in-the-middle attacks. This can compromise the confidentiality and integrity of network communications, and may expose the device to further network-based attacks that the VPN was intended to prevent. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High (Android Security Bulletin).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is extremely low at 0.000050, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Android Security Bulletin).

Google has released a patch for this vulnerability in the December 2025 Android Security Bulletin (patch level 2025-12-01). Users and administrators should update affected Android devices (versions 13.0, 14.0, and 15.0) to the December 2025 security patch level or later as soon as it is available from their device manufacturer. As an interim measure, organizations should review and restrict local user and application access on managed devices, and implement additional network security monitoring to detect unexpected VPN state changes (Android Security Bulletin, AOSP Commit).

Coverage of CVE-2025-48588 has been limited to aggregator and security news sites reporting on the broader December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified (BeyondMachines).