CVE-2025-48528: Android Frameworks Base Package Vulnerability Leading to Biometrics Overlay Attack
Summary
CVE-2025-48528: In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. Affects platform/frameworks/base across 3 version ranges.
>= 15:0, < 15:2025-09-01
>= 16:0, < 16:2025-09-01
>= 16-next:0, < 16-next:2025-09-01
Fixed in 16-next:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential functionalities for system UI and application frameworks. It manages user interactions, including biometric authentication features like fingerprint recognition. This package is critical for maintaining the security and integrity of user data, especially in biometric operations. However, it has been found to be vulnerable to a tapjacking/overlay attack, which could potentially allow malicious applications to exploit biometric overlays.
Vulnerability Detail
In multiple locations within the Android Frameworks Base package, there exists a vulnerability that allows for a possible overlay of biometric authentication interfaces. This vulnerability arises from improper handling of user interface elements, enabling attackers to perform tapjacking or overlay attacks. The ramifications of this vulnerability include local escalation of privileges, allowing unauthorized access to sensitive user data without requiring additional execution privileges. User interaction is not necessary for exploitation, making it particularly dangerous.
How To Fix
Minimum fixed version
16-next:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using biometric authentication features until the package is updated to the patched version. Additionally, users should be cautious about the applications they install and grant permissions to, especially those that interact with biometric data.
Conclusion
The CVE-2025-48528 vulnerability in the Android Frameworks Base package poses a significant risk due to its potential for biometric overlay attacks. Users are advised to update their systems promptly and remain vigilant about the applications they use. Utilizing tools like Vulert can further enhance security by providing real-time alerts on vulnerabilities.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48528 is a vulnerability in the Android Frameworks Base package that allows for tapjacking or overlay attacks on biometric authentication interfaces.
This vulnerability can lead to unauthorized access to sensitive user data by allowing malicious applications to overlay biometric interfaces, potentially escalating privileges without user consent.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
It is crucial to update the Android Frameworks Base package to the latest patched version as soon as it becomes available. Additionally, avoid using biometric features until the update is applied.
Vulert is a monitoring tool that uses the gradle.lockfile to alert users in real-time about open-source vulnerabilities in their software. It helps developers maintain security without needing access to the code.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
