{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-48651", "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6", "state": "PUBLISHED", "assignerShortName": "google_android", "dateReserved": "2025-05-22T18:12:46.995Z", "datePublished": "2026-04-06T18:20:31.044Z", "dateUpdated": "2026-04-06T19:29:44.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6", "shortName": "google_android", "dateUpdated": "2026-04-06T19:29:44.762Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Unknown"}]}], "affected": [{"vendor": "Google", "product": "Android", "versions": [{"version": "Android SoC", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "StrongBox in Android before security patch level 2026-04-05 has a vulnerability of High Severity, aka A-434039170, A-467765081, A-467765894, and A-467762899."}], "references": [{"url": "https://source.android.com/security/bulletin/2026-04-01"}, {"url": "https://source.android.com/docs/security/bulletin/2026/2026-04-01"}], "x_generator": {"engine": "cvelib 1.7.1"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "StrongBox in Android before security patch level 2026-04-05 has a vulnerability of High Severity, aka A-434039170, A-467765081, A-467765894, and A-467762899."}], "id": "CVE-2025-48651", "lastModified": "2026-04-06T20:16:20.030", "metrics": {}, "published": "2026-04-06T19:16:25.867", "references": [{"source": "security@android.com", "url": "https://source.android.com/docs/security/bulletin/2026/2026-04-01"}, {"source": "security@android.com", "url": "https://source.android.com/security/bulletin/2026-04-01"}], "sourceIdentifier": "security@android.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "Android SoC"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Android", "source": "cna", "vendor": "Google"}, "product": "android", "vendor": "google"}], "analysis": {"en": {"generated_at": "2026-04-07T01:21:30.733971+00:00", "value": {"mitigation_remediation": ["Apply the Android security patch released on 2026-04-05 to all affected devices", "Verify that the device reports the updated security patch level after installation", "Continue to monitor Android security bulletins for any additional information or mitigations", "Ensure that devices automatically receive updates or manually check for updates if automatic updates are disabled"], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Key Manipulation"}, "threat_synthesis": {"affected_systems": "All Android devices using StrongBox that have not applied the security patch released on 2026-04-05 are affected. This includes any Android version whose build date precedes the patch level, regardless of manufacturer, because the vulnerability is tied to the core StrongBox implementation rather than a specific vendor modification.", "description_and_impact": "StrongBox in Android is a secure enclave that stores cryptographic keys and performs secure operations. A vulnerability exists in versions of StrongBox before the security patch level 2026-04-05, and it is classified as High Severity. The description indicates that the issue could allow an attacker to interfere with or gain unauthorized access to the key material protected by StrongBox, which could lead to exposure or manipulation of confidential data. The exact mechanism and scope are not detailed in the available information, but the high severity rating suggests significant potential impact on confidentiality and integrity of data handled by the device.", "risk_and_exploitability": "The CVSS score for this vulnerability is marked High, indicating a severe risk profile, yet the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Attackers likely need to exploit this flaw within a device context, possibly requiring elevated privileges or physical access, as no remote exploitation path is described in the input. Given the uncertainty around exploitability, the vulnerability remains a significant concern for any system that relies on StrongBox for storing cryptographic material."}}}}, "created": "2026-04-07T06:54:44.118402+00:00", "title": "StrongBox Key Management Vulnerability", "updated": "2026-04-07T09:37:48.785639+00:00", "vendors": ["google", "google$PRODUCT$android"], "weaknesses": ["CWE-285", "CWE-200"]}