A critical local privilege escalation vulnerability in Google Android allows unauthorized access to user data and system privileges.

The flaw resides in multiple functions within Session.java, where a logic error permits unauthorized access to images owned by other users. This vulnerability can be triggered by a local attacker with low privileges, requiring no additional execution permissions or user interaction to achieve escalation.

The ability for a local attacker to escalate privileges and access private user data presents a significant risk to data confidentiality and device integrity. With a CVSS score of 7.8, this vulnerability is classified as High, indicating that successful exploitation could lead to full system compromise or unauthorized access to sensitive personal information stored on the device.

Immediate Action: Apply the official security patch provided by Google in the December 2025 Android Security Bulletin to all affected devices.

Proactive Monitoring: Review device access logs for unauthorized attempts to access system-level directories or unexpected session management activity.

Compensating Controls: Ensure that device-level security policies, such as mandatory full-disk encryption and restricted application permissions, are strictly enforced to minimize the potential impact of local privilege escalation.

Public Exploit Available: Unknown

Given the potential for local privilege escalation and the exposure of sensitive user data, this vulnerability poses a severe risk to Android environments. Administrators and users must prioritize the deployment of the December 2025 security updates to effectively mitigate this threat and ensure the continued security of device-resident information.