CVE-2025-48536: Android Settings Package Local Privilege Escalation Vulnerability
Summary
CVE-2025-48536: In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy. Affects platform/packages/apps/Settings across 5 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-next:0, < 16-next:2025-12-01
Fixed in 16-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Settings package is a core component of the Android operating system, responsible for managing device settings and configurations. It provides users with a user-friendly interface to adjust system preferences, manage applications, and control device functionalities. This package is critical for maintaining the overall user experience and security of Android devices. However, it is susceptible to vulnerabilities that can be exploited by malicious applications, potentially leading to unauthorized access and privilege escalation.
Vulnerability Detail
In the grantAllowlistedPackagePermissions function of SettingsSliceProvider.java, there exists a flaw that allows a third-party application to modify secure settings due to a confused deputy problem. This vulnerability can lead to local escalation of privileges without requiring additional execution privileges or user interaction, posing a significant security risk to the integrity of the device and user data.
How To Fix
Minimum fixed version
16-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions granted to third-party applications and avoid installing untrusted apps until the patch is applied. Regularly reviewing app permissions can also help mitigate potential exploitation.
Conclusion
The CVE-2025-48536 vulnerability in the Android Settings package poses a significant risk of local privilege escalation due to a flaw in the grantAllowlistedPackagePermissions function. Users are strongly advised to update their devices to the latest patched versions to mitigate this risk.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
CVE-2025-48536 is a vulnerability in the Android Settings package that allows unauthorized modification of secure settings by third-party applications.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The risks include unauthorized access to secure settings, potential data breaches, and local privilege escalation, which can compromise device security.
No, user interaction is not needed for exploitation, making it particularly dangerous.
Limit permissions for third-party applications and avoid installing apps from untrusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
