A vulnerability in the Android PackageParser component allows a local attacker to escalate privileges by bypassing lazy bundle hardening.

The vulnerability exists within the createIntentsList function of PackageParser.java, where unsafe deserialization permits the passing of modified data to subsequent processes, leading to local elevation of privilege without requiring user interaction.

The ability for a local user to escalate privileges poses a significant risk to the integrity and security of the Android operating system. A successful exploit could allow an attacker to gain elevated access, potentially leading to unauthorized data access, system compromise, or the installation of malicious applications. Given the CVSS score of 7.8, this flaw is categorized as High severity, necessitating prompt remediation to prevent potential unauthorized administrative actions on affected devices.

Immediate Action: Update affected Android devices to the June 2025 security patch level or later as provided by the device manufacturer.

Proactive Monitoring: Review system logs for signs of anomalous process behavior or unexpected privilege escalation attempts.

Compensating Controls: Ensure that only trusted applications are installed on devices and maintain strict control over user permissions to limit the potential impact of local escalation.

Public Exploit Available: No

This vulnerability represents a critical security gap in the Android framework that enables local privilege escalation. Security teams and administrators should prioritize the deployment of the June 2025 Android security bulletin updates across all managed devices. Failure to patch may expose devices to unauthorized privilege gains, and immediate remediation is strongly advised to maintain the security posture of the mobile environment.