A critical local privilege escalation vulnerability in Android 15 and 16 allows attackers to launch arbitrary activities, potentially resulting in full system compromise.

This is an elevation of privilege vulnerability occurring within the onCommand method of ActivityManagerShellCommand.java. It enables an attacker to perform an arbitrary activity launch via a confused deputy mechanism, which can be triggered by a local user without requiring elevated privileges or user interaction.

The ability for a local attacker to escalate privileges to the system level poses a severe risk to device integrity and user data privacy. With a CVSS score of 7.8, this high-severity flaw could allow unauthorized access to sensitive application data, system settings, or the bypass of security controls, potentially leading to total system compromise.

Immediate Action: Update affected Android devices to the security patch level specified in the September 2025 Android Security Bulletin.

Proactive Monitoring: Security teams should monitor device logs for unusual activity launches or unauthorized attempts to invoke shell commands that appear inconsistent with standard user behavior.

Compensating Controls: Ensure all applications follow the principle of least privilege and utilize Android's built-in sandboxing features to limit the potential impact of an escalated process.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Given the potential for full privilege escalation and the presence of a public proof-of-concept, this vulnerability represents a significant risk to Android deployments. Administrators and users must prioritize the application of the September 2025 security updates to mitigate the risk of local exploitation and maintain the security posture of their mobile environment.