CVE-2025-48620: 
NixOS vulnerability analysis and mitigation

CVE-2025-48620 is a local privilege escalation vulnerability in Android's VoiceInteractionManagerService.java that allows a third-party application's component name to persist even after the application is uninstalled, due to a logic error in the onSomePackagesChanged method. This flaw affects Android versions 13.0, 14.0, 15.0, and 16.0. It carries a CVSS v3.1 base score of 7.8 (High), requiring only low-privilege local access and no user interaction to exploit (Android Security Bulletin). The vulnerability was disclosed via the Google Android Security Bulletin dated December 1, 2025, with source code patches published on December 8, 2025.

The root cause is a logic error (CWE-269: Improper Privilege Management) in the onSomePackagesChanged method of VoiceInteractionManagerService.java, a system service responsible for managing voice interaction sessions on Android. When a third-party application that has registered a voice interaction component is uninstalled, the service fails to properly clean up the component name reference, allowing it to persist in the system state. An attacker with a low-privileged local application can exploit this stale reference to have their component treated as a trusted or elevated voice interaction service, enabling privilege escalation without requiring additional permissions or user interaction (Android Security Bulletin, Android Source Commit).

Successful exploitation allows a low-privileged local attacker to escalate privileges on the affected Android device, potentially achieving full system compromise. The vulnerability has high impact across confidentiality, integrity, and availability — an attacker could gain unauthorized access to sensitive user data, modify system state or settings, and potentially disrupt device availability. The attack is confined to the local device (scope unchanged), but the privilege escalation could enable further malicious actions such as installing persistent malware or accessing protected system resources (Android Security Bulletin).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Android Security Bulletin). The EPSS score is approximately 0.007%, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Google has released patches for this vulnerability as part of the December 2025 Android Security Bulletin (patch level 2025-12-01). Source code fixes are available via two commits to the Android platform frameworks/base repository (Android Source Commit 1, Android Source Commit 2). Users and administrators should apply the December 2025 security patch to all affected Android 13, 14, 15, and 16 devices as soon as OEM updates are available. As an interim measure, restricting installation of applications from untrusted sources and monitoring for suspicious local privilege escalation activity is recommended (Android Security Bulletin).

The vulnerability was covered in the context of Google's December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. Coverage appeared across security news outlets and aggregators including BeyondMachines, TheCyberThrone, and SammyFans in relation to Samsung's December 2025 security patch. Social media activity was limited, with automated CVE alert accounts such as RedPacketSecurity noting the disclosure. No notable independent researcher commentary or vendor statements beyond Google's bulletin have been identified.