CVE-2025-48618 — Improper Locking in Frameworks OPT Telephony

CWE-667 — Improper Locking5 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
0.0%
top 98.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Frameworks OPT TelephonyGoogle Android
Timeline
PublishedDec 8

Description

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages3 packages

▶Androidplatform/frameworks_opt_telephony16-qpr2-next:0 — 16-qpr2-next:2025-12-01+4
▶CVEListV5google/android4 versions+3
▶NVDgoogle/android4 versions+3

Patches

Patch: android.googlesource.com ↗

🔴Vulnerability Details

3
CVEList
CVE-2025-48618: In processLaunchBrowser of CommandParamsFactory↗2025-12-08
▶
GHSA
GHSA-568p-fv33-8r9x: In processLaunchBrowser of CommandParamsFactory↗2025-12-08
▶
OSV
CVE-2025-48618: In processLaunchBrowser of CommandParamsFactory↗2025-12-01
▶

📋Vendor Advisories

1
Android
CVE-2025-48618: Android Security Bulletin 2025-12-01 CVE: CVE-2025-48618 Severity: HIGH Type: EoP Affected AOSP versions: 13, 14, 15, 16 References: A-404254549↗2025-12-01
▶
CVE-2025-48618 — Improper Locking | cvebase