CVE-2025-48630: Android Frameworks Native Package GPU Cache Information Disclosure Vulnerability
Summary
CVE-2025-48630: In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. Affects platform/frameworks/native across 5 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2:0, < 16-qpr2:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Native package is a core component of the Android operating system, responsible for rendering graphics and managing GPU resources. It plays a crucial role in ensuring that applications can efficiently utilize hardware acceleration for graphics processing. However, vulnerabilities in this package can lead to significant security risks, including unauthorized access to sensitive information.
Vulnerability Detail
In the SkiaRenderEngine.cpp file, the drawLayersInternal function contains a flaw that allows for potential access to the GPU cache through side channel information disclosure. This vulnerability can lead to local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation, making it a critical security concern.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-48630 is a significant vulnerability in the Android Frameworks Native package that poses a risk of information disclosure through GPU cache access. Users are strongly advised to update their packages to the latest patched versions to protect against potential exploitation.
See every vulnerability recorded for platform/frameworks/native →
FAQ
CVE-2025-48630 is a vulnerability in the Android Frameworks Native package that allows unauthorized access to the GPU cache, potentially leading to information disclosure.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. By using the Vulert playground, you can check if your application is affected without requiring access to the code or installation.
The vulnerability can lead to local escalation of privilege, allowing attackers to access sensitive information without needing additional execution privileges.
No, user interaction is not needed for exploitation, making it a more severe security risk.
While there are no specific workarounds, it is crucial to prioritize updating your package to the patched version as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/native.
