CVE-2025-48633
Description
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Summary dbcve.org
A logic error in the hasAccountsOnAnyUser method of Android's DevicePolicyManagerService allows an attacker to add a Device Owner after the device provisioning process is complete. This bypasses the intended security control that should prevent Device Owner assignment post-provisioning, resulting in local privilege escalation without requiring user interaction or additional execution privileges.
Mitigation
Apply the latest Android security patch level which should contain the fix for this logic error in DevicePolicyManagerService.java. Organizations should ensure devices are updated to the latest available Android version and security patch level.