Medium · 5.5 CVE-2025-48608 EUVD-2025-201802GHSA-69fv-9j9v-qh3q

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead t…

Published Dec 8, 2025 · Updated Dec 8, 2025 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	16-qpr2	—

References

https://source.android.com/security/bulletin/android-16-qpr2