CVE-2025-48621: Android Frameworks Base and Native - Tapjacking Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2025-48621: In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base and Native packages are core components of the Android operating system, providing essential functionalities for application development and system operations. These packages manage various system-level tasks, including window management and input handling. The vulnerability in question arises from an insecure default configuration, which can be exploited to perform tapjacking attacks, allowing unauthorized privilege escalation.
Vulnerability Detail
In DefaultTransitionHandler.java, there exists a potential for a tapjacking attack due to an insecure default setting. This vulnerability allows an attacker to manipulate the user interface in such a way that the user unknowingly interacts with malicious content, leading to local escalation of privileges without requiring additional execution rights. User interaction is necessary for exploitation, making it a significant security concern for users and developers alike.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions granted to applications that may exploit this vulnerability until the patch is applied. Additionally, users should be cautious about the applications they install and the permissions they grant.
Conclusion
The CVE-2025-48621 vulnerability in the Android Frameworks Base and Native packages poses a significant risk of local privilege escalation through tapjacking attacks. It is crucial for users and developers to apply the necessary patches promptly and remain vigilant about application permissions to mitigate potential risks.
See every vulnerability recorded for platform/frameworks/base →
FAQ
A tapjacking attack is a malicious technique where an attacker tricks a user into clicking on something different from what the user perceives, potentially leading to unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your application's gradle.lockfile, you can determine if it is affected by this vulnerability.
Yes, user interaction is necessary for the exploitation of this vulnerability, as the attacker needs the user to unknowingly engage with the malicious content.
If immediate updates are not possible, consider limiting permissions for potentially vulnerable applications and remain vigilant about the applications you install.
Detailed information about this vulnerability can be found in the official Android security bulletin and on platforms like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
