CVE-2025-48566

In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

• CWE-20

• https://android.googlesource.com/platform/frameworks/base/+/0f3e248787d88154c8592f6e055b6b3586f4877dPatch, Product
• https://android.googlesource.com/platform/frameworks/base/+/28579dff4305f764302d85f95509671eafbf62acPatch, Product
• https://android.googlesource.com/platform/packages/modules/IntentResolver/+/4e6cf5285d0b1725fb9141e810050cfdb3fb42fdPatch, Product
• https://source.android.com/security/bulletin/2025-12-01Vendor Advisory

Published

Dec 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48560In AndroidManifest.xml, there is a possible way for an app t…5.5
• CVE-2025-48561In multiple locations, there is a possible way to access dat…5.5
• CVE-2025-48562In writeContent of RemotePrintDocument.java, there is a poss…5
• CVE-2025-48563In onNullBinding of RemoteFillService.java, there is a possi…7.8
• CVE-2025-48564In multiple locations, there is a possible intent filter byp…7
• CVE-2025-48565In multiple locations, there is a possible way to bypass the…7.8
• CVE-2025-48567In multiple locations, there is a possible bypass of a file …7.8
• CVE-2025-48568In multiple locations, there is a possible lockscreen bypass…7.4
• CVE-2025-48569In multiple locations, there is a possible permanent denial …5.5
• CVE-2025-4857The Newsletters plugin for WordPress is vulnerable to Local …7.2
• CVE-2025-48570In multiple functions of PipTaskOrganizer.java, there is a p…7.8
• CVE-2025-48571In multiple functions of btm_sec.cc, there is a possible way…4.3