A critical local privilege escalation vulnerability in Google Android allows attackers to bypass permission checks and gain unauthorized access.

The flaw resides in the getCallingPackageName function within CredentialStorage, where a logic error facilitates an elevation of privilege. This vulnerability allows a local attacker to gain elevated permissions without requiring user interaction or additional execution privileges.

Successful exploitation of this vulnerability permits a local attacker to bypass security constraints, potentially gaining full control over the device or accessing sensitive data protected by the CredentialStorage service. With a CVSS score of 7.8, this vulnerability poses a significant risk to the integrity and confidentiality of the affected mobile environment. Unauthorized privilege escalation can lead to complete system compromise, necessitating prompt remediation to prevent data theft or unauthorized administrative actions.

Immediate Action: Update all affected Android devices to the latest security patch level provided by Google or the device manufacturer as specified in the September 2025 Android Security Bulletin.

Proactive Monitoring: Review system logs for unusual permission requests or unauthorized attempts to access CredentialStorage functions.

Compensating Controls: Ensure that device-level security policies and managed application restrictions are strictly enforced to minimize the risk of malicious applications being installed on the device.

Public Exploit Available: Unknown

The vulnerability represents a severe risk to Android device security by enabling local privilege escalation. Security teams should prioritize the deployment of the September 2025 security updates across all managed mobile fleets to eliminate this exposure. Immediate patching is the only effective way to neutralize this threat and prevent potential exploitation by malicious local actors.