CVE-2025-48600
📋 TL;DR
This CVE describes a missing permission check vulnerability in Android's IntentResolver component that allows local information disclosure across user boundaries. Any Android device running vulnerable versions is affected, allowing one user to access another user's data without requiring additional privileges or user interaction.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete cross-user data leakage where an attacker can access sensitive personal data, authentication tokens, or private files from other user accounts on the same device.
Likely Case
Limited information disclosure where an attacker can access some metadata or non-sensitive user data, potentially enabling further attacks or privacy violations.
If Mitigated
No information disclosure occurs due to proper permission checks and isolation between user accounts.
🎯 Exploit Status
No user interaction required, but attacker needs local access to the device. The vulnerability is in the permission check mechanism itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: December 2025 Android Security Patch
Vendor Advisory: https://source.android.com/security/bulletin/2025-12-01
Restart Required: Yes
Instructions:
1. Apply the December 2025 Android Security Patch through Settings > System > System Update. 2. For enterprise devices, push the update through your MDM solution. 3. Verify the patch is applied by checking the security patch level in Settings > About phone.
🔧 Temporary Workarounds
Disable multi-user mode
androidPrevents cross-user attacks by disabling Android's multi-user feature
adb shell pm disable-user --user 0 com.android.systemui
Restrict app permissions
androidReview and restrict permissions for apps that use IntentResolver functionality
🧯 If You Can't Patch
- Isolate sensitive data to separate devices or user accounts with no shared access
- Implement strict access controls and monitoring for multi-user Android devices
🔍 How to Verify
Check if Vulnerable:
Check if the security patch level is older than December 2025 in Settings > About phone > Android version > Security patch levelCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify the security patch level shows December 2025 or later in Settings > About phone📡 Detection & Monitoring
Log Indicators:
- Unusual cross-user intent resolutions in system logs
- Permission denial logs for IntentResolver operations
Network Indicators:
- Not applicable - local vulnerability only
SIEM Query:
source="android_system" AND ("IntentResolver" OR "permission check") AND ("denied" OR "failed")