A critical local privilege escalation vulnerability in Google Android 14 and 15 allows unauthorized access to sensitive task snapshots.

This vulnerability exists in the loadDrawableForCookie function of ResourcesImpl.java, where a confused deputy flaw enables local attackers to gain unauthorized access to task snapshots of other applications without requiring user interaction.

The ability to access task snapshots of other applications poses a significant risk to data confidentiality and integrity. An attacker could potentially view sensitive information displayed in the background of other apps, leading to unauthorized data exposure and further privilege escalation within the device environment. With a CVSS score of 7.8, this vulnerability represents a high-severity risk to mobile device security.

Immediate Action: Users and administrators should apply the latest security updates provided by Google or the device manufacturer as specified in the June 2025 Android Security Bulletin.

Proactive Monitoring: Security teams should monitor device logs for unexpected access patterns related to system resources and inter-process communication.

Compensating Controls: Ensure that Play Protect is enabled and that all applications are installed from trusted sources to minimize the risk of malicious apps attempting to leverage this privilege escalation.

Public Exploit Available: Unknown

Given the potential for local privilege escalation, this vulnerability presents a serious threat to the Android ecosystem. Organizations managing mobile device fleets must prioritize the deployment of the June 2025 security patches to all supported Android 14 and 15 devices to prevent potential exploitation.