A local privilege escalation vulnerability in the Android operating system allows attackers to bypass permission prompts and gain unauthorized file access without user interaction.

The vulnerability exists within the getCallingAppName function in Shared.java, where improper input validation enables the manipulation of permission popups. This flaw allows an attacker with low privileges to trick the system into granting elevated file access without requiring user interaction.

Successful exploitation of this vulnerability results in a local escalation of privilege, granting unauthorized access to sensitive files on the device. Given the CVSS score of 7.8, this represents a significant security risk, as it undermines the core permission model of the Android operating system and could lead to complete data compromise or unauthorized system modifications.

Immediate Action: Organizations and individual users must apply the latest security updates provided by Google or their device manufacturer as soon as they become available.

Proactive Monitoring: Security teams should monitor device logs for suspicious application behavior or unauthorized attempts to access protected file directories.

Compensating Controls: Ensure that enterprise mobile management policies restrict the installation of applications from untrusted or unknown sources to reduce the attack surface.

Public Exploit Available: exploit_available (false)

The severity of this issue is high due to the potential for privilege escalation and the lack of required user interaction. Administrators are strongly encouraged to prioritize the deployment of the September 2025 Android security patches across all managed devices to neutralize this risk.