A high-severity local privilege escalation vulnerability in Google Android allows unauthorized access to user image data without requiring user interaction.

The vulnerability exists within Session.java due to a logic error that fails to properly isolate user data, allowing an attacker with local access to view images owned by other users. This flaw permits local elevation of privilege, and exploitation does not require specific user interaction or elevated execution privileges.

Successful exploitation of this vulnerability results in the unauthorized exposure of sensitive personal media and potential system-level compromise. With a CVSS score of 7.8, this flaw represents a significant risk to user privacy and device integrity, as it bypasses standard Android security boundaries for data isolation.

Immediate Action: Apply the official Android security updates provided in the December 2025 security bulletin to patch the vulnerable Session.java component.

Proactive Monitoring: Review system audit logs for anomalous file access patterns or unexpected attempts to access the media storage directory by unauthorized processes.

Compensating Controls: Ensure that all device users adhere to strict physical security practices to prevent unauthorized local access to the handset, which is the primary vector for this exploit.

Public Exploit Available: No

Given the potential for unauthorized access to private user data and the ability for an attacker to escalate privileges locally, this update should be prioritized across all managed Android devices. Organizations should ensure that the December 2025 Android security patches are deployed as part of their standard patch management cycle to mitigate this risk.