ASB-A-393582077

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-393582077.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-393582077
Aliases
  • A-393582077
  • CVE-2025-48580
Published
2025-12-01T00:00:00Z
Modified
2025-12-11T17:03:03.311367Z
Summary
[none]
Details

In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-12-01

Affected versions

Other

16-next

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "328844077187554695115703557215963058977",
                "length": 1079.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/f77a46ef79ffc62a22d0eb700420b9fdfde101c4",
            "id": "ASB-A-393582077-09580874",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "connectInternal"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "299262279779103325837321881806391803942",
                    "110525298203660710635175361034405340252",
                    "8428918895959798614580239526654591902"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/f77a46ef79ffc62a22d0eb700420b9fdfde101c4",
            "id": "ASB-A-393582077-30138eb8",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/service/media/MediaBrowserService.java"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "312735066293961005109864769537731011265",
                    "226370902197658332355565609890446927106",
                    "213775369474537450645870641712690184495",
                    "296479830668520742012937528564834235807",
                    "328030566193137563207533069452494750088",
                    "119459623198113351614249552272002154512",
                    "279082364328395055546962325449298675481"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/f77a46ef79ffc62a22d0eb700420b9fdfde101c4",
            "id": "ASB-A-393582077-8880c004",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java"
            },
            "signature_version": "v1",
            "deprecated": false
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/f77a46ef79ffc62a22d0eb700420b9fdfde101c4"
    ],
    "types": [
        "EoP"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-12-01

Affected versions

Other

15

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "113313274159869984408807532881971037285",
                "length": 1066.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7ed592c862936d227aaccd1532c6a3a423528aa5",
            "id": "ASB-A-393582077-3c9bea30",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "run"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "299262279779103325837321881806391803942",
                    "110525298203660710635175361034405340252",
                    "8428918895959798614580239526654591902"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7ed592c862936d227aaccd1532c6a3a423528aa5",
            "id": "ASB-A-393582077-6f4835e4",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/service/media/MediaBrowserService.java"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "329919832338193882455976616949025269220",
                    "61989241378589295897555660362629828434",
                    "201924084601368268815152031529988442424",
                    "52188141874304632563015285160846405841",
                    "34260494550320420882194119378252666050",
                    "311568021461633599364981330493287333329",
                    "99462040172380858902079016079287767510",
                    "298271950430253888256894522770758798051",
                    "7607250253040011231233078387161077919"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7ed592c862936d227aaccd1532c6a3a423528aa5",
            "id": "ASB-A-393582077-a5341f3b",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "function_hash": "329983638540771846667074122331540556692",
                "length": 1472.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/7ed592c862936d227aaccd1532c6a3a423528aa5",
            "id": "ASB-A-393582077-fc05b7a5",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "connect"
            },
            "signature_version": "v1",
            "deprecated": false
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/7ed592c862936d227aaccd1532c6a3a423528aa5"
    ],
    "types": [
        "EoP"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-12-01

Affected versions

Other

16

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "329919832338193882455976616949025269220",
                    "61989241378589295897555660362629828434",
                    "201924084601368268815152031529988442424",
                    "52188141874304632563015285160846405841",
                    "34260494550320420882194119378252666050",
                    "311568021461633599364981330493287333329",
                    "99462040172380858902079016079287767510",
                    "298271950430253888256894522770758798051",
                    "7607250253040011231233078387161077919"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c33d4bfc5b3093e469d52f45d116a78021778f7a",
            "id": "ASB-A-393582077-91adc66f",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "299262279779103325837321881806391803942",
                    "110525298203660710635175361034405340252",
                    "8428918895959798614580239526654591902"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c33d4bfc5b3093e469d52f45d116a78021778f7a",
            "id": "ASB-A-393582077-929601a1",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/service/media/MediaBrowserService.java"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "function_hash": "329983638540771846667074122331540556692",
                "length": 1472.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c33d4bfc5b3093e469d52f45d116a78021778f7a",
            "id": "ASB-A-393582077-9c03e8dd",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "connect"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "function_hash": "113313274159869984408807532881971037285",
                "length": 1066.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c33d4bfc5b3093e469d52f45d116a78021778f7a",
            "id": "ASB-A-393582077-e8c08075",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "run"
            },
            "signature_version": "v1",
            "deprecated": false
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/c33d4bfc5b3093e469d52f45d116a78021778f7a"
    ],
    "types": [
        "EoP"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-12-01

Affected versions

Other

13

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "329983638540771846667074122331540556692",
                "length": 1472.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-28ab2075",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "connect"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "function_hash": "113313274159869984408807532881971037285",
                "length": 1066.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-6f779786",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "run"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "299262279779103325837321881806391803942",
                    "110525298203660710635175361034405340252",
                    "8428918895959798614580239526654591902"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-892bdf2c",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/service/media/MediaBrowserService.java"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "329919832338193882455976616949025269220",
                    "61989241378589295897555660362629828434",
                    "201924084601368268815152031529988442424",
                    "52188141874304632563015285160846405841",
                    "34260494550320420882194119378252666050",
                    "311568021461633599364981330493287333329",
                    "99462040172380858902079016079287767510",
                    "298271950430253888256894522770758798051",
                    "7607250253040011231233078387161077919"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-d1928487",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java"
            },
            "signature_version": "v1",
            "deprecated": false
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e"
    ],
    "types": [
        "EoP"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-12-01

Affected versions

Other

14

Ecosystem specific 

{
    "spl": "2025-12-01",
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "329983638540771846667074122331540556692",
                "length": 1472.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-114c20e3",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "connect"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "329919832338193882455976616949025269220",
                    "61989241378589295897555660362629828434",
                    "201924084601368268815152031529988442424",
                    "52188141874304632563015285160846405841",
                    "34260494550320420882194119378252666050",
                    "311568021461633599364981330493287333329",
                    "99462040172380858902079016079287767510",
                    "298271950430253888256894522770758798051",
                    "7607250253040011231233078387161077919"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-5b79c79b",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "function_hash": "113313274159869984408807532881971037285",
                "length": 1066.0
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-b59124df",
            "signature_type": "Function",
            "target": {
                "file": "media/java/android/media/browse/MediaBrowser.java",
                "function": "run"
            },
            "signature_version": "v1",
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "299262279779103325837321881806391803942",
                    "110525298203660710635175361034405340252",
                    "8428918895959798614580239526654591902"
                ]
            },
            "source": "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e",
            "id": "ASB-A-393582077-c684dd70",
            "signature_type": "Line",
            "target": {
                "file": "media/java/android/service/media/MediaBrowserService.java"
            },
            "signature_version": "v1",
            "deprecated": false
        }
    ],
    "severity": "High",
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/c61afbfe43c3da7b72408a43b44b03bb13c3243e"
    ],
    "types": [
        "EoP"
    ]
}