Potential Launch Anywhere Vulnerability in Android Settings App by Google

CVE-2025-48535

What is CVE-2025-48535?

In the assertSafeToStartCustomActivity function of AppRestrictionsFragment.java within the Android Settings App, a vulnerability exists due to unsafe deserialization, enabling a potential exploit through parcel mismatch. This could allow unauthorized local privilege escalation without requiring any user interaction. Such a vulnerability can be particularly damaging, as it may enable attackers to perform actions that typically require higher execution privileges.

References