CVE-2025-48639: Android Frameworks Base and Native - Tapjacking Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2025-48639: In TBD of TBD, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android frameworks base and native packages are essential components of the Android operating system, providing core functionalities that enable applications to interact with the device's hardware and system resources. These frameworks manage user interface elements, input handling, and system services, making them critical for the overall performance and security of Android devices. The vulnerability in question arises from a tapjacking/overlay attack, which can unknowingly grant permissions to malicious applications, posing a significant risk to user privacy and device security.
Vulnerability Detail
In the Android frameworks base and native packages, a vulnerability exists that allows an attacker to exploit a tapjacking/overlay attack. This type of attack can lead to local escalation of privileges without requiring additional execution permissions. The vulnerability arises from improper handling of user interactions, enabling malicious applications to overlay themselves on legitimate applications, tricking users into granting permissions unknowingly. User interaction is necessary for exploitation, making it crucial for users to be aware of the applications they interact with.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid granting permissions to applications that request overlays or appear suspicious. It is advisable to review app permissions regularly and only install applications from trusted sources.
Conclusion
The CVE-2025-48639 vulnerability in the Android frameworks base and native packages poses a significant risk due to its potential for local privilege escalation through tapjacking attacks. Users are encouraged to update their packages to the latest versions and remain vigilant about app permissions to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for platform/frameworks/base →
FAQ
A tapjacking attack is a technique where a malicious application overlays itself on top of a legitimate application, tricking users into interacting with the malicious app instead of the intended one.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If you suspect your device has been compromised, immediately uninstall any suspicious applications, update your device to the latest software version, and consider performing a factory reset.
While specific apps may not be publicly identified, it is essential to be cautious of apps that request unnecessary permissions or overlays.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software. It uses the gradle.lockfile to provide insights into potential vulnerabilities in your applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
