erroneo.us
Search all guides⌘K

Security Digest · Dec 1, 2025 · Vulnerability · Mobile

Android CVE-2025-48633/48572: Exploited Framework Bugs

Two Android 13-16 Framework bugs under limited, targeted exploitation, fixed at patch level 2025-12-01. Find devices still below it and replace dead-end phones.

Published By erroneo.us Security Desk · Updated 3 min read12 sources

Our verdict

Check exposure

Fixed in the December 2025 patch level ten months ago; the job now is to find Android devices that never got it, mostly phones their maker stopped updating, and update or replace them.

Who must act: Organizations with company-owned or BYOD Android phones and tablets on Android 13 to 16 that report a security patch level before 2025-12-01, or that no longer receive updates at all.

Who can relax: Fleets where every Android device already reports patch level 2025-12-01 or later, and organizations with no Android devices touching company data.

Affected
Android 13, 14, 15 and 16 with a security patch level before 2025-12-01
Android 12 and earlier are not listed in the bulletin; no fix is published for them
Fixed in
Security patch level 2025-12-01 or later (2025-12-05 includes it)
Later exploited Android bugs need newer levels, for example 2026-06-01 for CVE-2025-48595
CVSS
7.8 (v3.1, CISA-ADP)
EPSS
0.3% (percentile 17)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Pull the security patch level of every managed Android device from your MDM and list any below 2025-12-01.
  2. Set a compliance rule that blocks corporate access below a recent patch level; 2026-06-01 also covers the later exploited Framework bug CVE-2025-48595.
  3. Push or prompt the update on non-compliant devices, starting with executives, admins and staff who travel.
  4. Replace devices whose maker no longer ships security updates, including anything stuck on Android 12 or earlier.
  5. On sensitive devices, check for a Device Owner or device admin app you did not provision.

How to check if you are affected or compromised

  • Run adb shell getprop ro.build.version.security_patch or read it in Settings; anything below 2025-12-01 was exposed.
  • Run adb shell dumpsys device_policy and look for a Device Owner or admin component you did not deploy, since CVE-2025-48633 allowed adding a Device Owner after setup.
  • Google has published no indicators of compromise or attacker details as of Oct 23, 2026; for high-risk users on unpatched phones, use a mobile forensics specialist.

What happened#

On December 1, 2025, Google published the Android Security Bulletin for December. It flagged two Framework bugs with the line "There are indications that the following may be under limited, targeted exploitation." Both are rated High and fixed at patch level 2025-12-01. CISA added both to the KEV catalog on December 2, with a December 23 deadline.

CVE-2025-48572 is an elevation of privilege bug. The CVE record says a permissions bypass in multiple locations allows launching activities from the background, with no user interaction. The AOSP fix changes how the media session service sends media-button events, so that it no longer "accidentally" passes background-launch abilities to the receiving app. CISA's enrichment scores it CVSS 3.1 7.8.

The bulletin lists CVE-2025-48633 as information disclosure. Its CVE record describes a logic error in hasAccountsOnAnyUser in DevicePolicyManagerService.java that makes it possible to add a Device Owner after the device has been set up. Device Owner is the role a management app holds on a fully managed phone. The fix is titled "Get all accounts no matter the visibility." NVD scores it 5.5, with high confidentiality impact.

Google has not said who used the bugs, against whom, or whether they were chained. SecurityWeek and The Register pointed to commercial spyware as a common source of such attacks, but that is their inference. As of Oct 23, 2026, no attribution has been published.

Who is affected#

Android 13, 14, 15 and 16 devices with a security patch level before 2025-12-01. The 2025-12-05 level includes both fixes. Phone makers ship the patches on their own schedules, so the patch level a device reports is what counts, not its Android version. Android 12 and older do not appear in the bulletin tables, so the bulletin offers them no fix.

Do you really need to act?#

For most fleets this is a hygiene check, not an emergency. Ten months on, supported phones from the major makers have had the December 2025 patches for a long time. Both bugs are local. CISA's scoring assumes the attacker already runs low-privileged code on the device, for example through a malicious app. "Limited, targeted" means a small number of chosen victims, not mass exploitation.

The risk sits in devices that stopped getting updates, makers that ship late, and personal phones outside your MDM. Patching for these two CVEs is also not enough. In June 2026, Google flagged another exploited Framework bug, CVE-2025-48595, fixed at patch level 2026-06-01. In September 2026, CISA added a Pixel modem bug, CVE-2026-58704.

What to do now#

  1. Export the security patch level of every Android device from your MDM and list everything below 2025-12-01.
  2. Set a compliance rule that blocks corporate access below a recent level. 2026-06-01 also covers CVE-2025-48595.
  3. Push or prompt updates, starting with high-risk users.
  4. Replace devices that no longer receive security updates, including anything on Android 12 or older.

How to tell if you were hit#

No indicators have been published. Check the patch level with adb shell getprop ro.build.version.security_patch. On sensitive devices, run adb shell dumpsys device_policy and look for a Device Owner or admin app you did not deploy. For a high-risk user whose phone stayed unpatched, get a mobile forensics specialist rather than relying on checks on the device.

Timeline#

  • — Google publishes the December bulletin and flags both CVEs as under limited, targeted exploitation.
  • — CISA adds both to KEV.
  • — The bulletin is revised to add AOSP links.
  • — The CVE records are published.
  • — KEV remediation deadline.
  • — Google flags another exploited Framework bug, CVE-2025-48595.

Vulnerability records

  • CVE-2025-48633 · KEV 2025-12-02 · In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code.
  • CVE-2025-48572 · KEV 2025-12-02 · In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Android — Android Security Bulletin, December 2025 source.android.com
  2. AOSP — frameworks/base d00bcda: Get all accounts no matter the visibility (CVE-2025-48633 fix) android.googlesource.com
  3. AOSP — frameworks/base e707f66: Add WIU/BFSL allowlisting to MediaButtonReceiverHolder.send (CVE-2025-48572 fix) android.googlesource.com
  4. CVE record — CVE-2025-48633 cve.org
  5. CVE record — CVE-2025-48572 cve.org
  6. NVD — CVE-2025-48633 nvd.nist.gov
  7. NVD — CVE-2025-48572 nvd.nist.gov
  8. CISA — Known Exploited Vulnerabilities: CVE-2025-48633 cisa.gov
  9. CISA — Known Exploited Vulnerabilities: CVE-2025-48572 cisa.gov
  10. Android — Android Security Bulletin, June 2026 source.android.com

Coverage and analysis

  1. SecurityWeek — Android Zero-Days Patched in December 2025 Security Update securityweek.com
  2. The Register — Two Android 0-day bugs disclosed and fixed, plus 105 more to patch theregister.com