A high-severity elevation of privilege vulnerability in the Android AccountTypePreferenceLoader component enables a local attacker to gain unauthorized system access.

This flaw involves a confused deputy mechanism within AccountTypePreferenceLoader.java that permits the bypass of intent type checks, allowing an attacker with local, low-privileged access to escalate privileges.

Successful exploitation of this vulnerability allows a malicious actor to elevate their privileges locally, potentially gaining full control over the affected device. Given the CVSS score of 7.8, this poses a significant risk to data confidentiality, integrity, and availability, as the attacker could bypass security boundaries to access sensitive user data or perform unauthorized system operations.

Immediate Action: Update affected Android devices to the security patch level specified in the September 2025 Android Security Bulletin.

Proactive Monitoring: Review system logs for unusual intent-related errors or unauthorized attempts to access system-level account management functions.

Compensating Controls: Since this is a local privilege escalation, ensure that untrusted applications are not installed on devices and that restrictive device management policies are enforced to limit potential attack surfaces.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates prompt action to protect device integrity. Organizations and individual users should verify their security patch level and apply the latest Android updates provided by their vendor immediately to mitigate the risk of local privilege escalation.