CVE-2025-48651

CVSS 4 MEDIUMEPSS 0.1%CWE-20

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

06 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Google · Android

References

https://source.android.com/docs/security/bulletin/2026/2026-04-01