CVE-2025-48635: 
NixOS vulnerability analysis and mitigation

CVE-2025-48635 is a local privilege escalation vulnerability in Android's TaskFragmentOrganizerController.java caused by a logic error that allows activity token leakage. It affects Android 14.0 and 15.0 and requires no additional execution privileges or user interaction to exploit. The vulnerability was published on March 2, 2026, and addressed in Google's Android March 2026 security bulletin (patch level 2026-03-01). It carries a CVSS v3.1 base score of 7.7 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is a logic error (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-532: Insertion of Sensitive Information into Log File; CWE-693: Protection Mechanism Failure) in multiple functions within TaskFragmentOrganizerController.java, a component of the Android Window Manager subsystem responsible for managing task fragment organizers. The flaw causes activity tokens — internal handles used to reference and control Android activities — to be improperly exposed to unauthorized local processes. An attacker with local code execution on the device can exploit this token leak to gain elevated privileges without requiring any additional permissions or user interaction (Android Security Bulletin).

Successful exploitation allows a local, unprivileged attacker to escalate privileges on the affected Android device by leveraging leaked activity tokens. The confidentiality and integrity impacts are rated High, as the attacker can access sensitive activity state information and potentially manipulate or hijack activities belonging to other applications or system processes. Availability is not directly impacted. This could enable an attacker to perform unauthorized actions on behalf of privileged applications, access protected data, or facilitate further compromise of the device (Android Security Bulletin, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the device, which limits the attack surface compared to remote vulnerabilities.

Google has released a patch addressing this vulnerability in the Android March 2026 security bulletin at patch level 2026-03-01, covering Android 14.0 and 15.0. Users and administrators should apply the March 2026 Android security update as soon as it becomes available for their devices. Samsung and other OEM vendors have begun rolling out the corresponding patches through their own update channels (Android Security Bulletin, Samsung Security). No configuration-based workaround is publicly documented; patching is the recommended remediation.

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in Google Android OS, including this issue, that could allow for privilege escalation (CIS Advisory). Samsung began rolling out the January/March 2026 security patches incorporating fixes for this and related vulnerabilities, with coverage noted in tech media (SammyFans). No significant independent researcher commentary or social media discussion specific to this CVE has been observed.