A critical privilege escalation vulnerability in the Android operating system allows local applications to bypass background activity launch restrictions and escalate privileges without user interaction.

The flaw resides in the clearAllowBgActivityStarts function within PendingIntentRecord.java, which fails to properly enforce restrictions on background activity starts, allowing a local attacker to escalate privileges.

This vulnerability carries a CVSS score of 7.8, reflecting its potential to grant an attacker elevated control over the device. A successful exploit could lead to full system compromise or unauthorized access to sensitive user data, posing a significant risk to organizational mobility and data security policies.

Immediate Action: Apply the Android security updates provided in the May 2025 bulletin to all managed mobile devices.

Proactive Monitoring: Monitor device security logs for unusual activity or unauthorized application behavior that may indicate an attempt to exploit background process permissions.

Compensating Controls: Enforce strict application vetting processes and utilize Mobile Device Management (MDM) solutions to restrict the installation of untrusted or unauthorized applications on corporate devices.

Public Exploit Available: No (exploit_available: false)

Given the potential for privilege escalation and the lack of required user interaction, this vulnerability represents a significant security risk to the Android ecosystem. Organizations must prioritize the deployment of the May 2025 Android security patches across their fleet to remediate this flaw and prevent potential local exploitation.