CVE-2025-48605: 
NixOS vulnerability analysis and mitigation

CVE-2025-48605 is an Android lockscreen bypass vulnerability caused by a logic error in multiple functions of KeyguardViewMediator.java, classified as a Protection Mechanism Failure (CWE-693). It affects Google Android versions 14, 15, and 16 (including Android 16 QPR2 beta variants). The vulnerability was published on March 2, 2026, as part of Google's March 2026 Android Security Bulletin. It carries a CVSS v3.1 base score of 8.4 (High), requiring no privileges and no user interaction for exploitation (Android Security Bulletin, Red Hat CVE).

The root cause is a logic error within multiple functions of KeyguardViewMediator.java, the Android component responsible for managing the device lockscreen (keyguard). This flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the lockscreen protection mechanism can be circumvented without triggering the expected authentication enforcement. The attack vector is local — an attacker with physical or local access to the device can exploit the logic flaw to bypass the lockscreen and escalate privileges without requiring any pre-existing execution privileges or user interaction (Android Security Bulletin, Red Hat CVE).

Successful exploitation allows a local attacker to bypass the device lockscreen and achieve local escalation of privilege on affected Android 14, 15, and 16 devices. This results in high impact to confidentiality, integrity, and availability — an attacker could gain unauthorized access to all data stored on the device, modify system settings or files, and potentially render the device unavailable. The vulnerability is particularly dangerous in scenarios involving lost or stolen devices, as it removes the primary physical access control (Android Security Bulletin, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.009% (0.000090), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported (Feedly).

Google addressed this vulnerability in the March 2026 Android Security Bulletin (patch level 2026-03-01), covering Android 14, 15, and 16. Users and administrators should apply the March 2026 security update as soon as it is available for their device. Samsung has also incorporated relevant patches into its monthly security updates, with coverage noted in the May 2026 Samsung security patch (Android Security Bulletin, CIS Advisory). Until patches are applied, organizations should enforce strict physical access controls to minimize exposure, as the attack vector is local.

The Center for Internet Security (CIS) issued an advisory noting multiple vulnerabilities in Google Android OS, including this lockscreen bypass, that could allow for privilege escalation (CIS Advisory). Samsung acknowledged the vulnerability in its security update communications, incorporating the fix into its monthly patch cycle (Samsung Security). No significant independent researcher commentary or social media discussion has been identified beyond standard vulnerability tracking and advisory coverage.