Third-Party Passkey Security Flaw in Android Products by Google

CVE-2025-48640

What is CVE-2025-48640?

A vulnerability has been identified in Google Android products where a missing permission check allows for third-party passkey entry pairing approval. This flaw can lead to potential adversaries escalating privileges without requiring any extra execution permissions. Notably, this issue can be exploited remotely, meaning that user interaction is not necessary for an attacker to take advantage of this security gap. It is crucial for users to keep their systems updated to mitigate the risks associated with this vulnerability.

References