A high-severity local privilege escalation vulnerability in Google Android allows attackers to bypass security boundaries and access data from other users.

The flaw exists in the validateUriSchemeAndPermission function within DisclaimersParserImpl.java, where a confused deputy vulnerability allows a local, low-privileged attacker to escalate privileges and access sensitive data.

Successful exploitation of this vulnerability permits unauthorized access to data belonging to other users on the device. Given the CVSS score of 7.8, the potential for total loss of confidentiality, integrity, and availability within the local context poses a significant risk to device security and user privacy.

Immediate Action: Update affected Android devices to the latest security patch level as specified in the September 2025 Android Security Bulletin.

Proactive Monitoring: Audit device logs for anomalous process behavior or unexpected access requests originating from the ManagedProvisioning package.

Compensating Controls: Ensure that third-party applications are sourced from trusted repositories and maintain strict device management policies to limit local user access where applicable.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to mobile device integrity by enabling local privilege escalation. Security teams should prioritize the deployment of the September 2025 Android security patches across all managed devices to remediate the underlying logic error and prevent potential unauthorized data access.