Medium

Android System local information disclosure due to missing permission check

IdentifiersCVE-2025-48600CWE-862· Missing Authorization

CVE-2025-48600 is a high-severity Android System information disclosure vulnerability. According to the provided content, the flaw exists in multiple files and is caused by a missing permission check, which allows information to be revealed across users. The issue enables local disclosure of data without requiring additional execution privileges, and no user interaction is needed for exploitation.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local attacker to access information belonging to another user context on the same device. The primary impact is cross-user information disclosure and exposure of sensitive system or user data. The provided content does not indicate code execution, privilege escalation, or remote exploitation.

Mitigation

If you can’t patch tonight, do this now.

If patching cannot be applied immediately, reduce exposure by limiting installation and execution of untrusted local applications, enforcing timely OS and OEM security updates, and restricting access to devices by untrusted users. Because the issue is local and requires no user interaction, mitigation is limited without vendor patches.

Remediation

Patch, then assume compromise.

Apply the Android security updates that include the fix for CVE-2025-48600. The provided content places this vulnerability in Google’s December 2025 Android Security Bulletin and indicates it is remediated at the 2025-12-05 patch level; Samsung also lists it as fixed in its April 2026 Security Maintenance Release. Deploy the relevant OEM firmware/security update for affected devices.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleAndroidoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cyberthroneNews

Dec 2, 2025

Android Patch Update December 2025

Android System component information-disclosure vulnerability fixed in the December 2025 bulletin.

samsung mobile securityNews

Jan 17, 2022

Security Updates Firmware Updates | Samsung Mobile Security

A high-severity Android Security Bulletin vulnerability patched by Samsung in the April 2026 Security Maintenance Release.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3