ASB-A-385736540

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-385736540.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-385736540
Aliases
  • A-385736540
  • CVE-2025-48572
Published
2025-12-01T00:00:00Z
Modified
2025-12-12T17:17:54.954870Z
Summary
[none]
Details

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-12-01

Affected versions

Other

16-next

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "316370734914974112922512838681362559473",
                "length": 1860.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0",
            "id": "ASB-A-385736540-0f871ef5",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java",
                "function": "send"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "function_hash": "186126368883898822795091504787417490532",
                "length": 1976.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0",
            "id": "ASB-A-385736540-12089638",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java",
                "function": "dispatchMediaKeyEventLocked"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "339810405352632085719091451311321674095",
                    "275975107146969956370038515730504573102",
                    "80497620183686386007736524282487791566",
                    "62418201323741799120306728308834156764",
                    "55865714173573915107216148403219505114",
                    "7648070471863515924186944870300117845",
                    "7795994052236267357960140086620066571",
                    "140715571409977858173753011776446487337",
                    "160791381214626622993839315322313461248",
                    "285823131317625649400454352761529686792",
                    "152489777678090466548466303667684018243",
                    "86157283484121117596203212179130565755",
                    "236661106157293379370043909333147044200",
                    "139494860666073456306352422804323662980",
                    "227089099119759810086834679082268080347",
                    "123925540056839143095672710156009698173",
                    "6758001863816488574372644869670397233",
                    "306937530902221669713689707599239301886",
                    "155655847639340755093639206222904693932",
                    "131606800696986250182282483148701001115",
                    "109373831995261988836437559702546324171",
                    "99917887084937512107958716423542590166",
                    "311037115874089012015679734201465496793",
                    "159119449463397141804386937033147939174",
                    "95387817101797232990380013837505315666",
                    "258037821717334382848300956764489571534",
                    "2061100622956081909542890173591037927",
                    "80181970134694028826649465051793635105",
                    "336648108446277117073573073154593819018",
                    "165572617918622412845323166496542590532"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0",
            "id": "ASB-A-385736540-44d31c3c",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "248725520175376610014865440393759759092",
                    "255221898688515736745163158731756297001",
                    "66919101396382129865736464723074217672",
                    "276533932626755003608503706335412412506",
                    "19460016803938391979888974122455004298",
                    "199356742234517526349997163450580743818",
                    "272313623517751408320150890528715246371",
                    "122229009202774695296209935430158122724",
                    "83600479556083361139501506086919843774",
                    "78026168801566047364994799468759064195"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0",
            "id": "ASB-A-385736540-ad788b76",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        }
    ],
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/ae004d8bbfc6ff3f72319ad86b3b9dcded7458e0"
    ],
    "severity": "High"
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-12-01

Affected versions

Other

15

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "316370734914974112922512838681362559473",
                "length": 1860.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e",
            "id": "ASB-A-385736540-0ddfc859",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java",
                "function": "send"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "function_hash": "186126368883898822795091504787417490532",
                "length": 1976.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e",
            "id": "ASB-A-385736540-8828627f",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java",
                "function": "dispatchMediaKeyEventLocked"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "248725520175376610014865440393759759092",
                    "255221898688515736745163158731756297001",
                    "66919101396382129865736464723074217672",
                    "276533932626755003608503706335412412506",
                    "19460016803938391979888974122455004298",
                    "199356742234517526349997163450580743818",
                    "272313623517751408320150890528715246371",
                    "122229009202774695296209935430158122724",
                    "83600479556083361139501506086919843774",
                    "78026168801566047364994799468759064195"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e",
            "id": "ASB-A-385736540-e5dc91e7",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "275975107146969956370038515730504573102",
                    "80497620183686386007736524282487791566",
                    "62418201323741799120306728308834156764",
                    "55865714173573915107216148403219505114",
                    "7648070471863515924186944870300117845",
                    "7795994052236267357960140086620066571",
                    "140715571409977858173753011776446487337",
                    "160791381214626622993839315322313461248",
                    "285823131317625649400454352761529686792",
                    "152489777678090466548466303667684018243",
                    "86157283484121117596203212179130565755",
                    "236661106157293379370043909333147044200",
                    "139494860666073456306352422804323662980",
                    "227089099119759810086834679082268080347",
                    "123925540056839143095672710156009698173",
                    "109373831995261988836437559702546324171",
                    "99917887084937512107958716423542590166",
                    "311037115874089012015679734201465496793",
                    "159119449463397141804386937033147939174",
                    "95387817101797232990380013837505315666",
                    "258037821717334382848300956764489571534",
                    "2061100622956081909542890173591037927",
                    "80181970134694028826649465051793635105",
                    "336648108446277117073573073154593819018",
                    "165572617918622412845323166496542590532"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e",
            "id": "ASB-A-385736540-ff6e203b",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        }
    ],
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/e7be2ddab161c1e96014a5ebe255af2ae42b3d4e"
    ],
    "severity": "High"
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-12-01

Affected versions

Other

16

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "248725520175376610014865440393759759092",
                    "255221898688515736745163158731756297001",
                    "66919101396382129865736464723074217672",
                    "276533932626755003608503706335412412506",
                    "19460016803938391979888974122455004298",
                    "199356742234517526349997163450580743818",
                    "272313623517751408320150890528715246371",
                    "122229009202774695296209935430158122724",
                    "83600479556083361139501506086919843774",
                    "78026168801566047364994799468759064195"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba",
            "id": "ASB-A-385736540-82654da4",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "digest": {
                "function_hash": "186126368883898822795091504787417490532",
                "length": 1976.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba",
            "id": "ASB-A-385736540-852a8203",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java",
                "function": "dispatchMediaKeyEventLocked"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "function_hash": "316370734914974112922512838681362559473",
                "length": 1860.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba",
            "id": "ASB-A-385736540-9c14fd83",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java",
                "function": "send"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "275975107146969956370038515730504573102",
                    "80497620183686386007736524282487791566",
                    "62418201323741799120306728308834156764",
                    "55865714173573915107216148403219505114",
                    "7648070471863515924186944870300117845",
                    "7795994052236267357960140086620066571",
                    "140715571409977858173753011776446487337",
                    "160791381214626622993839315322313461248",
                    "285823131317625649400454352761529686792",
                    "152489777678090466548466303667684018243",
                    "86157283484121117596203212179130565755",
                    "236661106157293379370043909333147044200",
                    "139494860666073456306352422804323662980",
                    "227089099119759810086834679082268080347",
                    "123925540056839143095672710156009698173",
                    "109373831995261988836437559702546324171",
                    "99917887084937512107958716423542590166",
                    "311037115874089012015679734201465496793",
                    "159119449463397141804386937033147939174",
                    "95387817101797232990380013837505315666",
                    "258037821717334382848300956764489571534",
                    "2061100622956081909542890173591037927",
                    "80181970134694028826649465051793635105",
                    "336648108446277117073573073154593819018",
                    "165572617918622412845323166496542590532"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba",
            "id": "ASB-A-385736540-c9f981fd",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        }
    ],
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/982bf7da1d1dd99a5d118ff2d5fdbec3780ebeba"
    ],
    "severity": "High"
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-12-01

Affected versions

Other

13

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "186126368883898822795091504787417490532",
                "length": 1976.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-17f3fbe8",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java",
                "function": "dispatchMediaKeyEventLocked"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "275975107146969956370038515730504573102",
                    "80497620183686386007736524282487791566",
                    "62418201323741799120306728308834156764",
                    "55865714173573915107216148403219505114",
                    "7648070471863515924186944870300117845",
                    "7795994052236267357960140086620066571",
                    "140715571409977858173753011776446487337",
                    "160791381214626622993839315322313461248",
                    "285823131317625649400454352761529686792",
                    "152489777678090466548466303667684018243",
                    "86157283484121117596203212179130565755",
                    "236661106157293379370043909333147044200",
                    "139494860666073456306352422804323662980",
                    "227089099119759810086834679082268080347",
                    "123925540056839143095672710156009698173",
                    "109373831995261988836437559702546324171",
                    "99917887084937512107958716423542590166",
                    "311037115874089012015679734201465496793",
                    "159119449463397141804386937033147939174",
                    "95387817101797232990380013837505315666",
                    "258037821717334382848300956764489571534",
                    "2061100622956081909542890173591037927",
                    "80181970134694028826649465051793635105",
                    "336648108446277117073573073154593819018",
                    "165572617918622412845323166496542590532"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-4cea93b6",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "248725520175376610014865440393759759092",
                    "255221898688515736745163158731756297001",
                    "66919101396382129865736464723074217672",
                    "276533932626755003608503706335412412506",
                    "19460016803938391979888974122455004298",
                    "199356742234517526349997163450580743818",
                    "272313623517751408320150890528715246371",
                    "122229009202774695296209935430158122724",
                    "83600479556083361139501506086919843774",
                    "78026168801566047364994799468759064195"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-812bb4a9",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "digest": {
                "function_hash": "316370734914974112922512838681362559473",
                "length": 1860.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-aa2cf3cf",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java",
                "function": "send"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        }
    ],
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0"
    ],
    "severity": "High"
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-12-01

Affected versions

Other

14

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "316370734914974112922512838681362559473",
                "length": 1860.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-061888ea",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java",
                "function": "send"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "function_hash": "186126368883898822795091504787417490532",
                "length": 1976.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-09103ec2",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java",
                "function": "dispatchMediaKeyEventLocked"
            },
            "signature_type": "Function",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "275975107146969956370038515730504573102",
                    "80497620183686386007736524282487791566",
                    "62418201323741799120306728308834156764",
                    "55865714173573915107216148403219505114",
                    "7648070471863515924186944870300117845",
                    "7795994052236267357960140086620066571",
                    "140715571409977858173753011776446487337",
                    "160791381214626622993839315322313461248",
                    "285823131317625649400454352761529686792",
                    "152489777678090466548466303667684018243",
                    "86157283484121117596203212179130565755",
                    "236661106157293379370043909333147044200",
                    "139494860666073456306352422804323662980",
                    "227089099119759810086834679082268080347",
                    "123925540056839143095672710156009698173",
                    "109373831995261988836437559702546324171",
                    "99917887084937512107958716423542590166",
                    "311037115874089012015679734201465496793",
                    "159119449463397141804386937033147939174",
                    "95387817101797232990380013837505315666",
                    "258037821717334382848300956764489571534",
                    "2061100622956081909542890173591037927",
                    "80181970134694028826649465051793635105",
                    "336648108446277117073573073154593819018",
                    "165572617918622412845323166496542590532"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-218a1d72",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "248725520175376610014865440393759759092",
                    "255221898688515736745163158731756297001",
                    "66919101396382129865736464723074217672",
                    "276533932626755003608503706335412412506",
                    "19460016803938391979888974122455004298",
                    "199356742234517526349997163450580743818",
                    "272313623517751408320150890528715246371",
                    "122229009202774695296209935430158122724",
                    "83600479556083361139501506086919843774",
                    "78026168801566047364994799468759064195"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0",
            "id": "ASB-A-385736540-87a76863",
            "deprecated": false,
            "target": {
                "file": "services/core/java/com/android/server/media/MediaSessionService.java"
            },
            "signature_type": "Line",
            "signature_version": "v1"
        }
    ],
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/739d2f4bd0a4b50acef264600e13fefd6a7c80c0"
    ],
    "severity": "High"
}