A logic vulnerability in the Google Android Companion Device Manager allows local attackers to elevate privileges without user interaction.

This is an elevation of privilege vulnerability caused by a logic error in the AssociationRequest.java file. An attacker with local access can exploit this flaw to gain unauthorized privileges, as the system incorrectly retains CDM associations.

Successful exploitation allows a local attacker to escalate privileges on a compromised device, potentially gaining full control over the affected system. Given the CVSS score of 7.8, this represents a significant security risk, as it bypasses standard permission boundaries and exposes sensitive user data or system functions to unauthorized manipulation.

Immediate Action: Apply the September 2025 Android Security Bulletin updates provided by Google or your device manufacturer to your systems.

Proactive Monitoring: Monitor device logs for unusual activity related to CDM association requests or unauthorized process execution.

Compensating Controls: Since this is a local privilege escalation, ensure that only trusted applications are installed on devices and utilize Mobile Device Management (MDM) policies to restrict unauthorized app installation.

Public Exploit Available: Unknown

This vulnerability presents a high risk for Android users due to the potential for local privilege escalation without user interaction. It is imperative that security teams prioritize the deployment of the September 2025 security patches to all managed Android devices to mitigate this risk.