high7.8

CVE-2025-48628

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy.

Impact

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 13.0, 14.0, 15.0, 16.0

Weakness classification

CWE-441

References

NVD record
CVE.org record
https://android.googlesource.com/platform/frameworks/base/+/9489a5dcd3cdd426d5b39d9caf6bb78142af2399
https://source.android.com/security/bulletin/2025-12-01