A high-severity SQL injection vulnerability in the Android PickerDbFacade component permits local privilege escalation and unauthorized data access on versions 14 and 15.

This vulnerability involves a SQL injection flaw within the PickerDbFacade.java component. An attacker with low privileges can exploit this to achieve local escalation of privilege, as the flaw does not require user interaction or additional execution permissions.

The ability to escalate privileges locally poses a significant security risk to mobile device integrity and data confidentiality. With a CVSS score of 7.8, this vulnerability indicates a high potential for unauthorized access to sensitive application data and the compromise of system-level controls, which could lead to complete device takeover if further chained.

Immediate Action: Update all affected Android devices to the latest security patch level provided in the September 2025 Android Security Bulletin.

Proactive Monitoring: Security teams should monitor for unusual system-level process behavior or unauthorized database queries originating from the MediaProvider package.

Compensating Controls: Ensure that third-party applications are sourced only from trusted repositories to minimize the risk of malicious apps attempting to leverage this local exploit.

Public Exploit Available: No

Given the high CVSS score and the nature of the flaw as a privilege escalation vector, administrators and users must prioritize the deployment of the September 2025 security updates. Prompt application of vendor patches is essential to mitigate the risk of local exploitation and ensure the continued integrity of the Android operating system.