A vulnerability in the Android BiometricEnrollIntroduction component could allow a local attacker to escalate privileges and access sensitive device location data.

This vulnerability is an elevation of privilege flaw caused by an unsafe PendingIntent in BiometricEnrollIntroduction.java. While the CVSS vector indicates low privileges are required, the flaw allows an attacker to bypass security constraints to gain unauthorized access.

The exploitation of this vulnerability leads to a total technical impact, allowing a local attacker to gain elevated privileges on the device. This poses a significant risk to data confidentiality and integrity, as unauthorized access to device location and system functions can facilitate further malicious activity. With a CVSS score of 7.8, this vulnerability is classified as High severity and requires prompt attention to prevent local compromise.

Immediate Action: Update affected Android devices to the version specified in the September 2025 Android Security Bulletin to resolve the unsafe PendingIntent handling.

Proactive Monitoring: Security teams should monitor device logs for unusual process execution patterns or unauthorized attempts to access location services by non-system applications.

Compensating Controls: Ensure that device security policies restrict the installation of untrusted applications, as this vulnerability requires local access to the device to execute.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and the sensitivity of the exposed location data, administrators should prioritize the deployment of the September 2025 security updates. Users should avoid side-loading applications from untrusted sources to reduce the likelihood of a local attacker gaining the necessary foothold to exploit this vulnerability.