Medium severity6.8NVD Advisory· Published Dec 8, 2025· Updated Jun 17, 2026

CVE-2025-48618

Description

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Android5 versions
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*
- (no CPE)range: 16
Android X86/android-x86llm-fuzzy

Patches

Vulnerability mechanics

References

android.googlesource.com/platform/frameworks/opt/telephony/+/fee68bcdcf029e8f40980616d09367610544bc62nvdPatchProduct
source.android.com/security/bulletin/2025-12-01nvdVendor Advisory

News mentions

Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G
Help Net Security · Aug 11, 2026
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
The Hacker News · Aug 11, 2026
Malicious SIMs can shut down phones, steal files, and drag 5G back to 2G
The Register Security · Aug 11, 2026

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000