CVE-2025-48654: 
NixOS vulnerability analysis and mitigation

CVE-2025-48654 is a local privilege escalation vulnerability in Android's CompanionDeviceManagerService.java, caused by a logic error in the onStart method that creates a confused deputy condition. It affects Google Android 16.0 (including QPR2 and QPR2 beta variants). The vulnerability was published on March 2, 2026, with a patch included in the March 2026 Android Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), manifesting as a confused deputy vulnerability in the onStart method of CompanionDeviceManagerService.java. A low-privileged local attacker can exploit the logic error to cause the service — which operates with elevated permissions — to perform actions on behalf of the attacker without proper authorization checks. No additional execution privileges are required, and user interaction is not needed for exploitation (Android Security Bulletin, Red Hat CVE).

Successful exploitation allows a local attacker with standard (low) privileges to escalate to higher system privileges on the affected Android 16.0 device, resulting in high impact to confidentiality, integrity, and availability. The attacker could read, modify, or delete sensitive data and disrupt system availability without requiring any user interaction or additional vulnerabilities (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.009% (very low), reflecting limited current exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat CVE, Android Security Bulletin).

Google released a patch addressing this vulnerability in the March 2026 Android Security Bulletin (patch level 2026-03-01), available as of March 2, 2026. Users and administrators should apply the March 2026 security update to all affected Android 16.0 devices as soon as possible. As an interim measure, restrict local access to devices to trusted users only and monitor for suspicious activity from low-privilege processes interacting with CompanionDeviceManagerService (Android Security Bulletin).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in the March 2026 Android OS update, including CVE-2025-48654, flagging potential for privilege escalation (CIS Advisory). Samsung also incorporated the March 2026 Android security patch into its own device updates, as noted by community coverage (SammyFans). No significant independent researcher commentary or social media discussion has been identified for this specific CVE.