Quick answers
- Is CVE-2025-48570 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-48570 being exploited in the wild.
- How severe is CVE-2025-48570?
- Informational severity, with a CVSS score of 7.8, published 1 June 2026.
- Which products and versions are affected?
- Google Android Framework 14.
- Is there a fix for CVE-2025-48570?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-48570 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2025-48570?
- Check whether you run Google Android Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A confused deputy vulnerability exists within multiple functions of PipTaskOrganizer.java in the Android Framework. The flaw allows a local malicious application to trigger activity launches from the background, bypassing standard Android security restrictions intended to prevent background apps from interrupting the user or gaining focus. This is classified as an Elevation of Privilege (EoP) vulnerability because it allows an app to perform actions (launching activities) that should be restricted based on its current state. Exploitation requires no additional execution privileges and no user interaction. The issue is addressed in the June 2026 Android Security Bulletin for Android version 14.
Affected products
- Google Android Framework 14
Timeline
- 2026-06-01: advisory: Published in the June 2026 Android Security Bulletin
- 2026-06-01: disclosed: CVE published to NVD dataset