CVE-2025-48611

In the DeviceId.java file, in the DeviceId method, range verification is missing during data operations. Omission of this check (CWE-120: buffer overflow) causes possible desynchronization in the data persistence mechanism. An attacker with local access to the device can exploit this irregularity without requiring user interaction or possession of elevated execution privileges.

An attacker can obtain local privilege escalation on a vulnerable Android device, potentially gaining control over system resources exceeding their original permission scope.

Security patches available from the manufacturer should be applied in accordance with references — Pixel Security Bulletin published 2026-03-01 at https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01

Google Android — versions indicated in manufacturer references (Pixel Security Bulletin from March 2026)