CVE-2025-48635: Android Frameworks Base Package Activity Token Leak Vulnerability
Summary
CVE-2025-48635: In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. Affects platform/frameworks/base across 3 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, responsible for providing essential services and functionalities to applications. It includes various classes and methods that manage system resources, user interactions, and application lifecycle events. This package is critical for the stability and security of Android devices, making it a prime target for vulnerabilities that could lead to unauthorized access or privilege escalation.
Vulnerability Detail
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This vulnerability allows for local escalation of privilege without requiring additional execution privileges or user interaction. The flaw originates from improper handling of activity tokens, which could potentially expose sensitive information or allow unauthorized actions within the system.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the affected functionalities within your application until the patch can be applied. This may involve disabling certain features that utilize the TaskFragmentOrganizerController until the update is implemented.
Conclusion
The CVE-2025-48635 vulnerability in the Android Frameworks Base package poses a significant risk due to the potential for local privilege escalation without user interaction. It is crucial to update to the patched version to mitigate this risk and ensure the security of applications relying on this framework.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48635 is a vulnerability in the Android Frameworks Base package that allows for a possible activity token leak, leading to local privilege escalation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your gradle.lockfile, you can identify if your application is impacted by this vulnerability.
The risks include unauthorized access to sensitive information and potential exploitation of the system, which could lead to further security breaches.
No, user interaction is not needed for exploitation, making it particularly concerning for application security.
Regularly check security advisories and use tools like Vulert to monitor your applications for vulnerabilities without needing to access the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
