A critical local privilege escalation vulnerability in Google Android allows an attacker to bypass contact permissions and gain unauthorized access to system functions.

The vulnerability exists within the onCreate method of the SelectAccountActivity component. Due to a logic error, an attacker with local access can perform actions, such as adding contacts, without obtaining the necessary user permissions.

This vulnerability poses a significant risk to data integrity and system security. Because it allows for local privilege escalation, an attacker could potentially gain unauthorized control over sensitive user data or system resources. With a CVSS score of 7.8, this flaw is categorized as High severity, as it facilitates unauthorized actions that could compromise the confidentiality and integrity of the device.

Immediate Action: Organizations and users must apply the security patches provided in the September 2025 Android Security Bulletin.

Proactive Monitoring: Security teams should monitor device logs for unexpected modifications to contact lists or irregular activity originating from the SelectAccountActivity component.

Compensating Controls: Ensure that third party applications are restricted by the Android permission model and that devices are kept up to date with the latest security patches to mitigate local attack vectors.

Public Exploit Available: Unknown

Given the potential for local privilege escalation, this vulnerability represents a serious risk to Android device security. Administrators and users should prioritize the installation of the September 2025 security updates to ensure the logic error in the SelectAccountActivity component is remediated. Failure to patch leaves the device susceptible to unauthorized permission bypasses and potential further system compromise.