Logic Error in Android Package Installer Affects Users Control
CVE-2025-48606

7.8HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
8 December 2025

What is CVE-2025-48606?

A logic error in the InstallPackageHelper.java file within the Android package installer allows an application to be installed in a hidden state, effectively preventing users from being able to locate or uninstall it. This vulnerability enables a potential local escalation of privileges, allowing the installed app to operate without requiring additional execution permissions. This issue does not necessitate user interaction, making it a concerning security flaw that can undermine user control and system integrity.

Affected Version(s)

Android 16-qpr2

References

https://source.android.com/security/bulletin/android-16-qpr2

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-48606 : Logic Error in Android Package Installer Affects Users Control