---
title: "Android CVE-2025-48633/48572: Exploited Framework Bugs"
url: https://erroneo.us/security/briefs/android-framework-cve-2025-48633-48572-zero-days/
description: "Two Android 13-16 Framework bugs under limited, targeted exploitation, fixed at patch level 2025-12-01. Find devices still below it and replace dead-end phones."
type: security-brief
section: "Security Digest"
date_published: 2025-12-01
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-48633", "CVE-2025-48572"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Android CVE-2025-48633/48572: Exploited Framework Bugs

**Verdict: Check exposure.** Fixed in the December 2025 patch level ten months ago; the job now is to find Android devices that never got it, mostly phones their maker stopped updating, and update or replace them.

- **Who must act:** Organizations with company-owned or BYOD Android phones and tablets on Android 13 to 16 that report a security patch level before 2025-12-01, or that no longer receive updates at all.
- **Who can relax:** Fleets where every Android device already reports patch level 2025-12-01 or later, and organizations with no Android devices touching company data.
- **Affected:** Android 13, 14, 15 and 16 with a security patch level before 2025-12-01; Android 12 and earlier are not listed in the bulletin; no fix is published for them
- **Fixed:** Security patch level 2025-12-01 or later (2025-12-05 includes it); Later exploited Android bugs need newer levels, for example 2026-06-01 for CVE-2025-48595
- **CVEs:** CVE-2025-48633, CVE-2025-48572
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull the security patch level of every managed Android device from your MDM and list any below 2025-12-01.
2. Set a compliance rule that blocks corporate access below a recent patch level; 2026-06-01 also covers the later exploited Framework bug CVE-2025-48595.
3. Push or prompt the update on non-compliant devices, starting with executives, admins and staff who travel.
4. Replace devices whose maker no longer ships security updates, including anything stuck on Android 12 or earlier.
5. On sensitive devices, check for a Device Owner or device admin app you did not provision.

### How to check if you are affected

- Run adb shell getprop ro.build.version.security_patch or read it in Settings; anything below 2025-12-01 was exposed.
- Run adb shell dumpsys device_policy and look for a Device Owner or admin component you did not deploy, since CVE-2025-48633 allowed adding a Device Owner after setup.
- Google has published no indicators of compromise or attacker details as of Oct 23, 2026; for high-risk users on unpatched phones, use a mobile forensics specialist.

## What happened

On December 1, 2025, Google published the [Android Security Bulletin for December](https://source.android.com/docs/security/bulletin/2025-12-01). It flagged two Framework bugs with the line "There are indications that the following may be under limited, targeted exploitation." Both are rated High and fixed at patch level 2025-12-01. CISA added both to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48572) on December 2, with a December 23 deadline.

CVE-2025-48572 is an elevation of privilege bug. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-48572) says a permissions bypass in multiple locations allows launching activities from the background, with no user interaction. The [AOSP fix](https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192) changes how the media session service sends media-button events, so that it no longer "accidentally" passes background-launch abilities to the receiving app. CISA's enrichment scores it CVSS 3.1 7.8.

The bulletin lists CVE-2025-48633 as information disclosure. Its [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-48633) describes a logic error in `hasAccountsOnAnyUser` in `DevicePolicyManagerService.java` that makes it possible to add a Device Owner after the device has been set up. Device Owner is the role a management app holds on a fully managed phone. The [fix](https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93) is titled "Get all accounts no matter the visibility." [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-48633) scores it 5.5, with high confidentiality impact.

Google has not said who used the bugs, against whom, or whether they were chained. [SecurityWeek](https://www.securityweek.com/androids-december-2025-updates-patch-two-zero-days/) and [The Register](https://www.theregister.com/2025/12/02/android_0_days/) pointed to commercial spyware as a common source of such attacks, but that is their inference. As of Oct 23, 2026, no attribution has been published.

## Who is affected

Android 13, 14, 15 and 16 devices with a security patch level before 2025-12-01. The 2025-12-05 level includes both fixes. Phone makers ship the patches on their own schedules, so the patch level a device reports is what counts, not its Android version. Android 12 and older do not appear in the bulletin tables, so the bulletin offers them no fix.

## Do you really need to act?

For most fleets this is a hygiene check, not an emergency. Ten months on, supported phones from the major makers have had the December 2025 patches for a long time. Both bugs are local. CISA's scoring assumes the attacker already runs low-privileged code on the device, for example through a malicious app. "Limited, targeted" means a small number of chosen victims, not mass exploitation.

The risk sits in devices that stopped getting updates, makers that ship late, and personal phones outside your MDM. Patching for these two CVEs is also not enough. In June 2026, Google flagged another exploited Framework bug, CVE-2025-48595, fixed at [patch level 2026-06-01](https://source.android.com/docs/security/bulletin/2026/2026-06-01). In September 2026, CISA added a Pixel modem bug, CVE-2026-58704.

## What to do now

1. Export the security patch level of every Android device from your MDM and list everything below 2025-12-01.
2. Set a compliance rule that blocks corporate access below a recent level. 2026-06-01 also covers CVE-2025-48595.
3. Push or prompt updates, starting with high-risk users.
4. Replace devices that no longer receive security updates, including anything on Android 12 or older.

## How to tell if you were hit

No indicators have been published. Check the patch level with `adb shell getprop ro.build.version.security_patch`. On sensitive devices, run `adb shell dumpsys device_policy` and look for a Device Owner or admin app you did not deploy. For a high-risk user whose phone stayed unpatched, get a mobile forensics specialist rather than relying on checks on the device.

## Timeline

- Dec 1, 2025 — Google publishes the December bulletin and flags both CVEs as under limited, targeted exploitation.
- Dec 2, 2025 — CISA adds both to KEV.
- Dec 4, 2025 — The bulletin is revised to add AOSP links.
- Dec 8, 2025 — The CVE records are published.
- Dec 23, 2025 — KEV remediation deadline.
- Jun 1, 2026 — Google flags another exploited Framework bug, CVE-2025-48595.

## Sources

1. [Android — Android Security Bulletin, December 2025](https://source.android.com/docs/security/bulletin/2025-12-01)
2. [AOSP — frameworks/base d00bcda: Get all accounts no matter the visibility (CVE-2025-48633 fix)](https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93)
3. [AOSP — frameworks/base e707f66: Add WIU/BFSL allowlisting to MediaButtonReceiverHolder.send (CVE-2025-48572 fix)](https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192)
4. [CVE record — CVE-2025-48633](https://www.cve.org/CVERecord?id=CVE-2025-48633)
5. [CVE record — CVE-2025-48572](https://www.cve.org/CVERecord?id=CVE-2025-48572)
6. [NVD — CVE-2025-48633](https://nvd.nist.gov/vuln/detail/CVE-2025-48633)
7. [NVD — CVE-2025-48572](https://nvd.nist.gov/vuln/detail/CVE-2025-48572)
8. [CISA — Known Exploited Vulnerabilities: CVE-2025-48633](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48633)
9. [CISA — Known Exploited Vulnerabilities: CVE-2025-48572](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48572)
10. [Android — Android Security Bulletin, June 2026](https://source.android.com/docs/security/bulletin/2026/2026-06-01)
11. [SecurityWeek — Android Zero-Days Patched in December 2025 Security Update](https://www.securityweek.com/androids-december-2025-updates-patch-two-zero-days/)
12. [The Register — Two Android 0-day bugs disclosed and fixed, plus 105 more to patch](https://www.theregister.com/2025/12/02/android_0_days/)

---
Source page: https://erroneo.us/security/briefs/android-framework-cve-2025-48633-48572-zero-days/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt