cbcvebase.
CVE-2025-48608
published 2025-12-08

CVE-2025-48608: In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information…

medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

2 ranges
VendorProductVersion rangeFixed in
googleandroid——
googleandroid——