CVE-2025-48608

MEDIUM · 5.5 CVSS Gepubliceerd: 08-12-2025 CWE-862

Beschrijving

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Vendors

Google

Affected products

Android

References

source.android.com