A logic vulnerability in Google Android 15 permits unauthorized local privilege escalation by allowing secondary users to bypass primary user security settings.

This vulnerability involves a logic error within the ContentProtectionTogglePreferenceController.java component, which allows a locally authenticated secondary user to disable the primary user's deceptive app scanning setting without requiring additional privileges or user interaction.

The ability for a secondary user to modify security settings for the primary user represents a significant breakdown in Android permission isolation. This flaw could be leveraged to disable security protections, potentially exposing the primary user to malicious applications that would otherwise be blocked, resulting in compromised device integrity and data privacy. Given the CVSS score of 7.8, this constitutes a High severity risk for multi-user device environments.

Immediate Action: Apply the security updates provided in the May 2025 Android Security Bulletin. Ensure all devices running Android 15 are patched to the version containing the fix for this specific logic error.

Proactive Monitoring: Monitor system logs for unauthorized changes to security configuration settings, particularly in environments where multiple user profiles are active on a single device.

Compensating Controls: Restrict the creation of secondary user accounts on sensitive devices where such isolation is critical, until all devices can be fully updated to a patched version of Android.

Public Exploit Available: Unknown

This vulnerability represents a critical failure in the security boundary between user profiles on Android 15. System administrators managing fleets of Android devices should prioritize the deployment of the May 2025 security patches to restore proper access control and ensure the integrity of deceptive app scanning protections. Immediate patching is the only effective method to mitigate this risk.