A high-severity local privilege escalation vulnerability in Google Android versions 13 through 16 poses a significant risk to device security through a confused deputy flaw.

This vulnerability occurs within AppRestrictionsFragment.java where a confused deputy scenario allows an attacker to bypass intent security checks. The flaw requires low privileges and local access to execute, potentially granting unauthorized elevated control over the device.

The ability to escalate privileges locally presents a severe risk to organizational device integrity and data confidentiality. With a CVSS score of 7.8, this vulnerability allows a malicious actor with limited access to compromise system-level functions, potentially leading to unauthorized data access or full device takeover.

Immediate Action: Apply the September 2025 Android security updates provided by Google to all affected devices.

Proactive Monitoring: Monitor system logs for unusual intent-related errors or unexpected application behavior originating from settings-related components.

Compensating Controls: Ensure that third-party applications are restricted from unnecessary permissions, as this limits the potential reach of an attacker who has successfully escalated their privileges.

Public Exploit Available: Unknown.

Given the potential for complete system impact, security teams should prioritize the deployment of the September 2025 security bulletin across their mobile fleet. Prompt patching is essential to prevent local attackers from abusing the confused deputy mechanism to gain administrative control over Android devices.