CVE-2025-48602: 
NixOS vulnerability analysis and mitigation

CVE-2025-48602 is an Android lockscreen bypass vulnerability caused by a logic error in the exitKeyguardAndFinishSurfaceBehindRemoteAnimation method of KeyguardViewMediator.java. It affects Google Android versions 14.0, 15.0, and 16.0 (including QPR2 beta variants). The flaw allows a local attacker with physical device access to bypass the lockscreen and escalate privileges without requiring any additional execution privileges or user interaction. It was published on March 2, 2026, and addressed in the Android March 2026 security bulletin (2026-03-01). It carries a CVSS v3.1 base score of 8.4 (High) (Android Bulletin, Red Hat CVE).

The root cause is classified as CWE-693 (Protection Mechanism Failure) — specifically, a logic error in the keyguard animation exit routine within KeyguardViewMediator.java. The vulnerable method exitKeyguardAndFinishSurfaceBehindRemoteAnimation fails to properly enforce lockscreen state transitions during remote animation completion, allowing the protection mechanism to be bypassed under certain conditions. The attack vector is local (physical access required), with low attack complexity, no privileges required, and no user interaction needed. No public proof-of-concept code has been identified at this time (Android Bulletin, Red Hat CVE).

Successful exploitation allows an unauthenticated local attacker with physical access to the device to completely bypass the lockscreen, resulting in high confidentiality, integrity, and availability impact on the affected device. An attacker could gain full access to the device's data, applications, and settings without knowing the PIN, password, or biometric credentials. This poses a significant risk for lost or stolen devices, as all data stored on the device becomes accessible to the attacker (Android Bulletin).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the time of reporting. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. Exploitation requires physical access to the device, which limits the attack surface compared to remote vulnerabilities (Red Hat CVE, Android Bulletin).

Google addressed this vulnerability in the Android Security Bulletin for March 2026 (patch level 2026-03-01), released on March 2, 2026. Users and administrators should apply the March 2026 security update to all affected Android 14.0, 15.0, and 16.0 devices as soon as it becomes available from their device manufacturer. As a compensating control prior to patching, organizations should enforce full-disk encryption and consider enabling remote wipe capabilities for managed devices to reduce risk from physical access scenarios (Android Bulletin, CIS Advisory).

The Center for Internet Security (CIS) issued an advisory noting that multiple vulnerabilities in the March 2026 Android update, including CVE-2025-48602, could allow for privilege escalation and recommended prompt patching (CIS Advisory). Security news outlets such as GBHackers covered the broader March 2026 Android security update, which addressed 129 flaws including this lockscreen bypass (GBHackers). No significant independent researcher commentary or social media discussion specific to this CVE has been identified.