CVE-2025-48633: medium-severity vulnerability in Google Android
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Android's Device Policy Manager allows someone to add a Device Owner account after the device has already been set up, bypassing normal security checks. This could let an attacker gain administrative control over the device without needing special permissions or user approval.
CVE-2025-48633 exploits a logic error in hasAccountsOnAnyUser() of DevicePolicyManagerService.java that permits Device Owner provisioning post-setup. The attack vector is local; no additional privileges or user interaction required. Successful exploitation results in privilege escalation to Device Owner level, granting administrative device control.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.