CVE-2025-48526Medium· 4.0▾ SunlitIn createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper input validation. This could lead to local escalation of privilege with no ad…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.09%
In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another profile due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Android 16Android 15Android 14Android 13Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-48528Medium· 4.0In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack
CVE-2025-32347High· 7.8In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent
CVE-2025-48541High· 7.8In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation
CVE-2025-48529Medium· 5.5In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy
CVE-2026-49912Medium· 4.0In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code
CVE-2026-59005High· 8.4In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check