CVE-2025-48626 is a critical flaw (CVSS 9.8 in the record) in Android, where a failed precondition check lets an application be launched from the background. The record describes remote escalation of privilege with no user interaction. The December 2025 Android bulletin lists the fix at the 2025-12-01 patch level.
What's affected
The record says the issue exists "in multiple locations" and links two source changes in the Android Open Source Project: one in the frameworks base and one in the Launcher3 app. It also links the Android Security Bulletin for December 2025.
That bulletin lists CVE-2025-48626 as an elevation of privilege issue with a severity of High and names AOSP versions 13, 14, 15 and 16 as updated. The CVE record carries a CVSS 9.8 Critical score with a network attack vector, so the two sources differ on severity. Android's own rating is the one that matters for planning your patch cycle, and both agree on the remedy.
The fix is delivered in the 2025-12-01 security patch level or later. Device makers ship these updates on their own schedule, so the date your phones reach that level depends on the vendor and the carrier.
How to check if you're exposed
On a device, open Settings, then About phone, then Android version, and read the Android security update date. You want 1 December 2025 or later.
For a fleet managed through a tool, you can read the same value over a debug connection:
adb shell getprop ro.build.version.security_patch
The command prints a date such as 2025-12-01. Anything earlier than that date does not have the fix. Mobile device management tools report this value for enrolled devices, so you can filter on it and build a list of devices that are behind.
Also list the Android versions in use. The bulletin names versions 13 to 16 as updated. Devices on older, unsupported Android versions may get no fix at all, and should be replaced or restricted.
What to do now
- Install the December 2025 security update, or a later one, on all Android devices that receive updates.
- Use your device management tool to report devices that are below the 2025-12-01 patch level, and set a compliance deadline.
- For devices that no longer receive updates, limit what they can access, or retire them.
- Keep app installs to trusted stores, and keep automatic updates on.
- Confirm the patch level again after the update, because a failed or deferred install is common.
Why it matters
The record classifies the weakness as CWE-693, protection mechanism failure. Android limits when an app can start an activity while it runs in the background, to stop apps from popping up screens or taking actions the user did not start. Here, a precondition check failed in the code that enforces that limit, so the limit could be bypassed.
The record describes the outcome as privilege escalation without extra execution privileges and without user interaction. The bulletin summary for this group of fixes describes escalation and background activity launch. Neither source says the issue has been exploited, and it is not in the CISA Known Exploited Vulnerabilities catalogue.
The practical lesson is about update speed. Mobile fixes are public when the bulletin is published, while real devices stay unpatched for weeks or months. The gap is yours to measure, using the patch level value above, and to close through policy.
Quick check
Which patch level fixes CVE-2025-48626?
The December 2025 Android Security Bulletin lists it at the 2025-12-01 patch level. Devices at that level or later include the fix.
Why does the severity differ between sources?
The Android bulletin rates it High, while the CVE record carries a 9.8 Critical score. Use the patch level as the decision point, since both sources call for the same update.
Sources
Last reviewed: 18 October 2026.
