CVE-2025-48570

Background Activity Launch Vulnerability Leading to Local Privilege Escalation in Android

View on CVE.org
Published Jun 1, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Analysis

AI-generated

Technical impact

The vulnerability involves a confused‑deputy scenario in the PipTaskOrganizer component of Android, allowing an application to launch an activity from the background without user interaction. This misuse permits a local attacker to gain higher privileges on the device, representing an improper access control flaw (CWE-441) and a confused‑deputy flaw (CWE-441) that can be exploited without additional privileges.

Affected Systems

The defect is present in Google Android systems that include the PipTaskOrganizer module; specific version details are not disclosed. All affected Android installations that contain this component are susceptible until patched.

Risk and Exploitability

This vulnerability has a CVSS score of 7.8, indicating high severity. Exploitation is feasible locally on the device and requires no user interaction, making it a high‑risk privilege escalation. EPSS score of <1% and the vulnerability is not listed in the CISA KEV catalog, but the lack of a need for remote access or an exploit payload increases its potential impact for an adversary with physical or local access.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Android security patch that addresses the PipTaskOrganizer activity launch bug
  • Disable background activity launching for apps via device settings or developer options, if the option is available
  • Monitor device activity logs for unexpected background launches and investigate any anomalies

Generated by OpenCVE AI on June 2, 2026 at 18:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Background Activity Launch Vulnerability Leading to Local Privilege Escalation in Android
CPEs cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Background Activity Launch Allows Local Privilege Escalation in Android
Weaknesses CWE-284
Type Values Removed Values Added
Weaknesses CWE-441
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Background Activity Launch Allows Local Privilege Escalation in Android
First Time appeared Google
Google android
Weaknesses CWE-284
Vendors & Products Google
Google android
Type Values Removed Values Added
Description In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')

Sources

Status
PUBLISHED
Assigner
google_android
Published
Updated
Jun 3, 2026, 3:55 AM
Reserved
May 22, 2025, 6:11 PM

View source JSON

Updated
Jun 2, 2026, 1:29 PM

JSON

Status
Analyzed
Published
Jun 1, 2026, 10:16 PM
Modified
Jul 22, 2026, 8:10 AM

View source JSON

No data.

Updated
Jun 2, 2026, 6:45 PM

JSON