CVE-2025-48612: 
NixOS vulnerability analysis and mitigation

CVE-2025-48612 is a local privilege escalation vulnerability in Android's NFC payment settings component, specifically in the setDefaultKey method of DefaultPaymentSettings.java. Due to improper input validation, an application (including those running on a work profile) can modify the main user's default NFC payment setting without authorization. The vulnerability affects Android versions 13.0, 14.0, 15.0, and 16.0. It was disclosed on December 8, 2025, as part of Google's December 2025 Android Security Bulletin, and carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin).

The root cause is classified as CWE-20 (Improper Input Validation) in the setDefaultKey function within DefaultPaymentSettings.java in the Android Settings package. A low-privileged local application — including apps running in a work profile — can exploit this flaw to set the main user's default NFC payment application without requiring elevated permissions or user interaction. The attack vector is local, with low attack complexity and no privilege escalation prerequisites beyond a basic installed application. A patch commit is publicly available at the Android open-source repository (Android Source Commit, Android Security Bulletin).

Successful exploitation allows a low-privileged application to silently override the main user's default NFC payment application, potentially redirecting contactless payment transactions to an attacker-controlled payment handler. This results in high impacts to confidentiality, integrity, and availability, as the attacker gains unauthorized control over critical payment configuration. The vulnerability is particularly concerning on shared or enterprise-managed devices where work profile apps could manipulate the primary user's financial settings without any visible indication (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000080, reflecting a low probability of near-term exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Android Security Bulletin).

1. Install a malicious app: Deploy a low-privileged application on the target Android device (versions 13–16), potentially via a work profile or sideloading.
2. Invoke the vulnerable API: The malicious app calls the setDefaultKey method in DefaultPaymentSettings.java with a crafted input that bypasses input validation checks.
3. Override NFC payment default: The app successfully sets the main user's default NFC payment application to an attacker-controlled payment handler without user interaction or elevated privileges.
4. Intercept payments: When the victim initiates an NFC contactless payment, the transaction is routed through the attacker's payment application, enabling financial fraud or data capture (Android Security Bulletin).

• Logs: Android system logs showing unexpected calls to DefaultPaymentSettings.setDefaultKey from a non-system or work-profile application; audit logs reflecting changes to the default NFC payment application without user-initiated action.
• Settings: Unexpected change in the default NFC payment application under Settings > Connected devices > NFC > Default payment app, particularly if changed to an unfamiliar or recently installed application.
• Process/Application: Presence of a recently installed low-privileged app with NFC-related permissions (e.g., CHANGE_NFC_STATE, NFC) that is not a recognized payment application.

Google released patches addressing this vulnerability in the December 2025 Android Security Bulletin (patch level 2025-12-01) and the June 2026 bulletin (patch level 2026-06-01). Users and administrators should update Android devices running versions 13, 14, 15, or 16 to the latest patched security update. Samsung has also incorporated the fix in its June 2026 security update. As a workaround, administrators managing enterprise devices should restrict work profile applications from accessing NFC payment settings via Mobile Device Management (MDM) policies until patches are applied (Android Security Bulletin, June 2026 Bulletin, Samsung Security).

The vulnerability was covered in Google's December 2025 Android Security Bulletin and received standard coverage from security aggregators such as SOCRadar and BeyondMachines, which noted it among over 100 vulnerabilities patched in that release cycle. RedPacket Security flagged it on social media. No notable independent researcher commentary or significant community debate has been identified beyond routine patch reporting (SOCRadar, BeyondMachines).