ASB-A-339637822

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-339637822.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-339637822
Aliases
  • A-339637822
  • CVE-2025-48573
Published
2025-12-01T00:00:00Z
Modified
2025-12-05T16:54:09.441467Z
Summary
[none]
Details

In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use abuse. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-12-01

Affected versions

Other

16-next

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/ef878077fe520900d783f8a4ad15a97be338ba29"
    ],
    "vanir_signatures": [
        {
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "295663147934602901587685930669195904430",
                    "300644691175556851590189198817654268614",
                    "274794278707599360813111154090886855229",
                    "98575725188023173122146020946782549228",
                    "95538261545296973792931279416195847451",
                    "251042773400171008829640301421303257542",
                    "286826685401867512882207169272084512588",
                    "217209414885596656948544539395390919157",
                    "270534985031001244675366669005810674762"
                ],
                "threshold": 0.9
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ef878077fe520900d783f8a4ad15a97be338ba29",
            "deprecated": false,
            "id": "ASB-A-339637822-2c43a5b0",
            "signature_type": "Line"
        },
        {
            "target": {
                "function": "sendCommand",
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "length": 412.0,
                "function_hash": "91563271606762283751811484693224499195"
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ef878077fe520900d783f8a4ad15a97be338ba29",
            "deprecated": false,
            "id": "ASB-A-339637822-b0ec8938",
            "signature_type": "Function"
        }
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-12-01

Affected versions

Other

15

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/52fbff99bc75c97b593c566c14973a2a2dbdd524"
    ],
    "vanir_signatures": [
        {
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "98575725188023173122146020946782549228",
                    "95538261545296973792931279416195847451",
                    "251042773400171008829640301421303257542",
                    "286826685401867512882207169272084512588",
                    "217209414885596656948544539395390919157",
                    "270534985031001244675366669005810674762"
                ],
                "threshold": 0.9
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/52fbff99bc75c97b593c566c14973a2a2dbdd524",
            "deprecated": false,
            "id": "ASB-A-339637822-e9659296",
            "signature_type": "Line"
        },
        {
            "target": {
                "function": "sendCommand",
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "length": 412.0,
                "function_hash": "91563271606762283751811484693224499195"
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/52fbff99bc75c97b593c566c14973a2a2dbdd524",
            "deprecated": false,
            "id": "ASB-A-339637822-fd04f21d",
            "signature_type": "Function"
        }
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-12-01

Affected versions

Other

16

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/67427c408ade557307d44b632addbabfcd825cbf"
    ],
    "vanir_signatures": [
        {
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "98575725188023173122146020946782549228",
                    "95538261545296973792931279416195847451",
                    "251042773400171008829640301421303257542",
                    "286826685401867512882207169272084512588",
                    "217209414885596656948544539395390919157",
                    "270534985031001244675366669005810674762"
                ],
                "threshold": 0.9
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/67427c408ade557307d44b632addbabfcd825cbf",
            "deprecated": false,
            "id": "ASB-A-339637822-36b60446",
            "signature_type": "Line"
        },
        {
            "target": {
                "function": "sendCommand",
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "length": 412.0,
                "function_hash": "91563271606762283751811484693224499195"
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/67427c408ade557307d44b632addbabfcd825cbf",
            "deprecated": false,
            "id": "ASB-A-339637822-97951981",
            "signature_type": "Function"
        }
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-12-01

Affected versions

Other

13

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154"
    ],
    "vanir_signatures": [
        {
            "target": {
                "function": "sendCommand",
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "length": 411.0,
                "function_hash": "291510612482705506915375350621778202628"
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154",
            "deprecated": false,
            "id": "ASB-A-339637822-58036a17",
            "signature_type": "Function"
        },
        {
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "98575725188023173122146020946782549228",
                    "95538261545296973792931279416195847451",
                    "251042773400171008829640301421303257542",
                    "286826685401867512882207169272084512588",
                    "217209414885596656948544539395390919157",
                    "274623443125498352259103935175234676367"
                ],
                "threshold": 0.9
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154",
            "deprecated": false,
            "id": "ASB-A-339637822-9c2fdb06",
            "signature_type": "Line"
        }
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-12-01

Affected versions

Other

14

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154"
    ],
    "vanir_signatures": [
        {
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "line_hashes": [
                    "98575725188023173122146020946782549228",
                    "95538261545296973792931279416195847451",
                    "251042773400171008829640301421303257542",
                    "286826685401867512882207169272084512588",
                    "217209414885596656948544539395390919157",
                    "274623443125498352259103935175234676367"
                ],
                "threshold": 0.9
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154",
            "deprecated": false,
            "id": "ASB-A-339637822-7864580f",
            "signature_type": "Line"
        },
        {
            "target": {
                "function": "sendCommand",
                "file": "services/core/java/com/android/server/media/MediaSessionRecord.java"
            },
            "signature_version": "v1",
            "digest": {
                "length": 411.0,
                "function_hash": "291510612482705506915375350621778202628"
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/37de99f4813e3dd027412720a99721bb43828154",
            "deprecated": false,
            "id": "ASB-A-339637822-d4c163ab",
            "signature_type": "Function"
        }
    ]
}