CVE-2025-48649: Android Framework Base Package - User Permissions Bypass Vulnerability
Summary
CVE-2025-48649: In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework Base package is a core component of the Android operating system, providing essential services and APIs for application development. It manages various system-level functionalities, including permissions, application lifecycle, and resource management. This package is crucial for maintaining the security and integrity of user applications, making it a prime target for vulnerabilities that could lead to privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2025-48649 allows for a potential bypass of user-selected permissions in multiple locations within the Android Framework Base package. This issue arises from improper handling of permission resets, which could lead to local escalation of privileges without requiring additional execution rights. The exploitation of this vulnerability does not necessitate user interaction, making it particularly concerning for device security.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually review and adjust application permissions through the device settings. However, this does not fully mitigate the risk associated with the vulnerability and is not a substitute for applying the patch.
Conclusion
CVE-2025-48649 represents a significant security risk within the Android Framework Base package, allowing for potential privilege escalation through a permissions bypass. Users and developers are urged to apply the available patch promptly to safeguard their applications and devices.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48649 is a vulnerability in the Android Framework Base package that allows for a bypass of user-selected permissions, potentially leading to privilege escalation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized applications to gain elevated privileges, compromising user data and device security.
Yes, a patch is available in version 17-next:2026-06-01 of the Android Framework Base package. Users should update to this version or later.
If you cannot update your device, consider reviewing and managing application permissions manually, but be aware that this is not a complete solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
