Local Privilege Escalation in NFC Payment Settings of Android by Google

CVE-2025-48612

What is CVE-2025-48612?

A vulnerability exists in Google's Android operating system that allows an application running on a work profile to potentially alter the default NFC payment settings for the main user. This flaw arises from inadequate input validation across several locations, enabling a local escalation of privilege without requiring any additional execution privileges or user interaction to exploit. Users should be aware of this vulnerability to mitigate risks associated with unauthorized changes to NFC payment configurations.

References