A high-severity local privilege escalation vulnerability exists in Google Android, potentially allowing attackers to compromise system integrity and availability.

This vulnerability is a logic error within the handlePackagesChanged function of the DevicePolicyManagerService, which permits local escalation of privilege. The flaw does not require user interaction or elevated execution privileges to trigger.

Successful exploitation allows a local attacker to gain unauthorized privileges on the affected device, resulting in a potential compromise of data confidentiality, integrity, and system availability. With a CVSS score of 7.8, this vulnerability represents a high risk that could lead to full system compromise if an attacker gains local access to the device.

Immediate Action: Apply the September 2025 security updates provided by Google to the affected Android devices.

Proactive Monitoring: Monitor system logs for unusual crashes or abnormal behavior within the DevicePolicyManagerService component.

Compensating Controls: Ensure that device security policies are strictly enforced and that applications are only installed from trusted sources to minimize the risk of local malicious actors.

Public Exploit Available: No confirmed public exploit exists.

Given the potential for local privilege escalation, organizations should prioritize the deployment of the September 2025 Android security bulletin. Administrators must ensure all managed devices are patched to prevent exploitation of this logic error in the DevicePolicyManagerService.