CVE-2025-48574: Android Frameworks Base Package Local Escalation of Privilege Vulnerability
Summary
CVE-2025-48574: In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. Affects platform/frameworks/base across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, responsible for providing essential services and functionalities to applications. It includes various libraries and APIs that facilitate interaction with the device hardware and system resources. This package is critical for the overall performance and security of Android devices. However, it is susceptible to vulnerabilities that can lead to security breaches, such as the one described in this report.
Vulnerability Detail
In the validateAddingWindowLw method of DisplayPolicy.java, there is a missing permission check that allows an application to intercept drag-and-drop events. This vulnerability can lead to local escalation of privilege, enabling unauthorized access to sensitive operations without requiring additional execution privileges or user interaction. The flaw is present in multiple versions of the Android Frameworks Base package, making it a significant security concern.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional permission checks in your application to mitigate the risk of unauthorized access to drag-and-drop events until the package can be updated.
Conclusion
The CVE-2025-48574 vulnerability in the Android Frameworks Base package poses a significant risk of local privilege escalation due to a missing permission check. It is crucial for developers to update their packages to the patched versions to ensure the security of their applications. Utilizing tools like Vulert can help monitor and identify vulnerabilities in real-time.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48574 is a vulnerability in the Android Frameworks Base package that allows local escalation of privilege due to a missing permission check in the validateAddingWindowLw method.
This vulnerability can allow malicious applications to intercept drag-and-drop events, potentially leading to unauthorized access to sensitive data or operations within your application.
The vulnerability affects multiple versions, including versions 14, 15, and 16 prior to the patch released on 2026-03-01.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. By utilizing the Vulert playground at Vulert Scanner, you can check if your application is affected without requiring any signup.
If immediate updates are not possible, implement additional permission checks in your application as a temporary workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
