ASB-A-407991863

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-407991863.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-407991863
Aliases
  • A-407991863
  • CVE-2025-48551
Published
2025-09-01T00:00:00Z
Modified
2025-10-17T15:04:01.284263Z
Summary
[none]
Details

In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

References

Affected packages

Android

platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-09-01

Affected versions

Other

16-next

Ecosystem specific 

{
    "severity": "High",
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "digest": {
                "length": 1076.0,
                "function_hash": "13551692267448640322011329785694535553"
            },
            "target": {
                "function": "createChooserActionFactory",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-18e1fd2d"
        },
        {
            "digest": {
                "length": 233.0,
                "function_hash": "323284697402033748502362556147759193773"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUserWithSharedElementTransition",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-2eab2a28"
        },
        {
            "digest": {
                "line_hashes": [
                    "101867369588014950103656102534358821707",
                    "306317194483053207422188037157900621166",
                    "160704426539494366591003738758916495784",
                    "250505936468956827345688033794110805308",
                    "38110673141087757322453494509165873632",
                    "263020739624223882215767155794144171013",
                    "12581600653319617402095056905476819087",
                    "242675786657752986316363911326688576847",
                    "113598120556158122422212532223929533082",
                    "203376803130579902081891824873622264748",
                    "73278888427881404821125899453025325784",
                    "149291900467549066537035040469300260079",
                    "319777538284908730802494626434147733682"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActionFactory.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-b1bc9c67"
        },
        {
            "digest": {
                "length": 194.0,
                "function_hash": "240378617240652965689360248545942313658"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUser",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-caec7362"
        },
        {
            "digest": {
                "line_hashes": [
                    "191684362313041103910639584061440084609",
                    "101238107343338534671556334115778645243",
                    "312272753975339174460263663704996197702",
                    "316737928140337932985375736483104906698",
                    "51030993241440003271557109854314720193",
                    "148588984285673899417251448276044105628",
                    "267973568473889827732076559226717262849",
                    "266728393104373898561121824742978717708",
                    "272548406537954011371976724840357484752",
                    "273435684415834733979840313965185499811",
                    "16444793135684385830004128812814362401",
                    "113851401835958233725467456239499213966",
                    "247709104266419015309245606849544611230",
                    "196920599025561022912430987150445089516",
                    "254148657175062542047695876185173522672",
                    "262890387773751971460085399055530455991",
                    "249478260178805007681202637392626858775"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-fa8b3cd2"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/29da3d663edd566f0b5c4dce434f40aa7e3877de"
    ],
    "types": [
        "ID"
    ]
}

platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15:0
Fixed
15:2025-09-01

Affected versions

Other

15

Ecosystem specific 

{
    "severity": "High",
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "digest": {
                "length": 1092.0,
                "function_hash": "302941098379555003077789850142935967202"
            },
            "target": {
                "function": "createChooserActionFactory",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-3071f14b"
        },
        {
            "digest": {
                "line_hashes": [
                    "101867369588014950103656102534358821707",
                    "306317194483053207422188037157900621166",
                    "160704426539494366591003738758916495784",
                    "250505936468956827345688033794110805308",
                    "38110673141087757322453494509165873632",
                    "263020739624223882215767155794144171013",
                    "12581600653319617402095056905476819087",
                    "39171250668676078779636413394271869408",
                    "28407457052572686512380454671399400150",
                    "307006698909406281218548744980688865759",
                    "73278888427881404821125899453025325784",
                    "149291900467549066537035040469300260079",
                    "319777538284908730802494626434147733682"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActionFactory.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-5d5b37a9"
        },
        {
            "digest": {
                "line_hashes": [
                    "191684362313041103910639584061440084609",
                    "101238107343338534671556334115778645243",
                    "312272753975339174460263663704996197702",
                    "316737928140337932985375736483104906698",
                    "51030993241440003271557109854314720193",
                    "148588984285673899417251448276044105628",
                    "267973568473889827732076559226717262849",
                    "266728393104373898561121824742978717708",
                    "272548406537954011371976724840357484752",
                    "273435684415834733979840313965185499811",
                    "16444793135684385830004128812814362401",
                    "113851401835958233725467456239499213966",
                    "247709104266419015309245606849544611230",
                    "196920599025561022912430987150445089516",
                    "254148657175062542047695876185173522672",
                    "262890387773751971460085399055530455991",
                    "249478260178805007681202637392626858775"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-69a75336"
        },
        {
            "digest": {
                "length": 194.0,
                "function_hash": "240378617240652965689360248545942313658"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUser",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-8e7b935f"
        },
        {
            "digest": {
                "length": 233.0,
                "function_hash": "323284697402033748502362556147759193773"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUserWithSharedElementTransition",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-cc5c6243"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/f54a0bbd15ffe6bf3c90f362c18487de4fbbc5ac"
    ],
    "types": [
        "ID"
    ]
}

platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-09-01

Affected versions

Other

16

Ecosystem specific 

{
    "severity": "High",
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "digest": {
                "length": 194.0,
                "function_hash": "240378617240652965689360248545942313658"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUser",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-08112b41"
        },
        {
            "digest": {
                "length": 1076.0,
                "function_hash": "13551692267448640322011329785694535553"
            },
            "target": {
                "function": "createChooserActionFactory",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-0b47bebd"
        },
        {
            "digest": {
                "line_hashes": [
                    "191684362313041103910639584061440084609",
                    "101238107343338534671556334115778645243",
                    "312272753975339174460263663704996197702",
                    "316737928140337932985375736483104906698",
                    "51030993241440003271557109854314720193",
                    "148588984285673899417251448276044105628",
                    "267973568473889827732076559226717262849",
                    "266728393104373898561121824742978717708",
                    "272548406537954011371976724840357484752",
                    "273435684415834733979840313965185499811",
                    "16444793135684385830004128812814362401",
                    "113851401835958233725467456239499213966",
                    "247709104266419015309245606849544611230",
                    "196920599025561022912430987150445089516",
                    "254148657175062542047695876185173522672",
                    "262890387773751971460085399055530455991",
                    "249478260178805007681202637392626858775"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-3bc1a894"
        },
        {
            "digest": {
                "length": 233.0,
                "function_hash": "323284697402033748502362556147759193773"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUserWithSharedElementTransition",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-b07972bb"
        },
        {
            "digest": {
                "line_hashes": [
                    "101867369588014950103656102534358821707",
                    "306317194483053207422188037157900621166",
                    "160704426539494366591003738758916495784",
                    "250505936468956827345688033794110805308",
                    "38110673141087757322453494509165873632",
                    "263020739624223882215767155794144171013",
                    "12581600653319617402095056905476819087",
                    "242675786657752986316363911326688576847",
                    "113598120556158122422212532223929533082",
                    "203376803130579902081891824873622264748",
                    "73278888427881404821125899453025325784",
                    "149291900467549066537035040469300260079",
                    "319777538284908730802494626434147733682"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActionFactory.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-e1648c1b"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/aa51b0dd71221238b6a260378984601ecb9f520d"
    ],
    "types": [
        "ID"
    ]
}

platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-09-01

Affected versions

Other

13

Ecosystem specific 

{
    "severity": "High",
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "digest": {
                "length": 391.0,
                "function_hash": "45104543738673210472238066676239106515"
            },
            "target": {
                "function": "createEditButton",
                "file": "core/java/com/android/internal/app/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9b1ff63998d55df2d83b621936f208141fccd440",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-1d2cba59"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/9b1ff63998d55df2d83b621936f208141fccd440"
    ],
    "types": [
        "ID"
    ]
}

platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13:0
Fixed
13:2025-09-01

Affected versions

Other

13

Ecosystem specific 

{
    "severity": "High",
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "digest": {
                "length": 981.0,
                "function_hash": "225375004455393503844768829223253270480"
            },
            "target": {
                "function": "createChooserActionFactory",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-3a491525"
        },
        {
            "digest": {
                "line_hashes": [
                    "306317194483053207422188037157900621166",
                    "160704426539494366591003738758916495784",
                    "250505936468956827345688033794110805308",
                    "38110673141087757322453494509165873632",
                    "263020739624223882215767155794144171013",
                    "12581600653319617402095056905476819087",
                    "221358284901460111307386848473599325514",
                    "91945753141763271557920024618697485775",
                    "96171429012762838835873678271290242922",
                    "73278888427881404821125899453025325784",
                    "149291900467549066537035040469300260079",
                    "319777538284908730802494626434147733682"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActionFactory.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-4421371c"
        },
        {
            "digest": {
                "length": 208.0,
                "function_hash": "118513060201645892355221372295299131725"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUserWithSharedElementTransition",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-75f483f0"
        },
        {
            "digest": {
                "line_hashes": [
                    "266728393104373898561121824742978717708",
                    "272548406537954011371976724840357484752",
                    "273435684415834733979840313965185499811",
                    "16444793135684385830004128812814362401",
                    "113851401835958233725467456239499213966",
                    "236606869047989475060792167035641461756",
                    "163020257386826003367960892947713014593",
                    "298270253870408552887739644662143015772",
                    "93203456567668770104794014186121128499"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-919ec2d3"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/24e1829dfc5bb9421bb7e83ec157112c75c7dde2"
    ],
    "types": [
        "ID"
    ]
}

platform/packages/modules/IntentResolver

Package

Name
platform/packages/modules/IntentResolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
14:0
Fixed
14:2025-09-01

Affected versions

Other

14

Ecosystem specific 

{
    "severity": "High",
    "spl": "2025-09-01",
    "vanir_signatures": [
        {
            "digest": {
                "length": 208.0,
                "function_hash": "118513060201645892355221372295299131725"
            },
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUserWithSharedElementTransition",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-0365bafb"
        },
        {
            "digest": {
                "line_hashes": [
                    "81317462932937850074127772825786738745",
                    "306317194483053207422188037157900621166",
                    "160704426539494366591003738758916495784",
                    "250505936468956827345688033794110805308",
                    "38110673141087757322453494509165873632",
                    "263020739624223882215767155794144171013",
                    "12581600653319617402095056905476819087",
                    "221358284901460111307386848473599325514",
                    "91945753141763271557920024618697485775",
                    "96171429012762838835873678271290242922",
                    "73278888427881404821125899453025325784",
                    "149291900467549066537035040469300260079",
                    "319777538284908730802494626434147733682"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActionFactory.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-9cb49698"
        },
        {
            "target": {
                "function": "safelyStartActivityAsPersonalProfileUser",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "id": "ASB-A-407991863-c4d811bb",
            "match_only_versions": [
                "14"
            ],
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5",
            "deprecated": false,
            "digest": {
                "length": 85.0,
                "function_hash": "76915311157816807900452246902169939769"
            },
            "signature_version": "v1"
        },
        {
            "digest": {
                "length": 956.0,
                "function_hash": "137758203882507555422735954598301607436"
            },
            "target": {
                "function": "createChooserActionFactory",
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Function",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-c6ba406a"
        },
        {
            "digest": {
                "line_hashes": [
                    "191684362313041103910639584061440084609",
                    "156649594227928834755303296606932545171",
                    "5082048086147984494691902163362061902",
                    "54305167445319589251627817046794153330",
                    "316911568431114403042689894604115283216",
                    "266728393104373898561121824742978717708",
                    "272548406537954011371976724840357484752",
                    "273435684415834733979840313965185499811",
                    "16444793135684385830004128812814362401",
                    "113851401835958233725467456239499213966",
                    "236606869047989475060792167035641461756",
                    "163020257386826003367960892947713014593",
                    "298270253870408552887739644662143015772",
                    "93203456567668770104794014186121128499"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "java/src/com/android/intentresolver/ChooserActivity.java"
            },
            "signature_type": "Line",
            "source": "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5",
            "deprecated": false,
            "signature_version": "v1",
            "id": "ASB-A-407991863-c7e716f7"
        }
    ],
    "fixes": [
        "https://android.googlesource.com/platform/packages/modules/IntentResolver/+/e49d1835c10f537d54004abb61ae6cc8ee1011b5"
    ],
    "types": [
        "ID"
    ]
}