A race condition vulnerability in the Android operating system enables local attackers to achieve privilege escalation without user interaction or elevated requirements.

The flaw is a race condition affecting intent filters, which can be exploited by a local attacker to achieve elevation of privilege. The vulnerability does not require user interaction and can be triggered with low-level local privileges.

The ability to escalate privileges locally poses a significant threat to device integrity and user data privacy. A successful exploit grants an attacker elevated control over the device, potentially bypassing security boundaries that protect sensitive applications and system-level data. With a CVSS score of 7.0, this vulnerability represents a high risk to the confidentiality, integrity, and availability of information stored on affected Android devices.

Immediate Action: Organizations and users should apply the December 2025 Android security updates as soon as they become available from device manufacturers.

Proactive Monitoring: Security teams should monitor device logs for suspicious patterns of intent-related errors or unexpected privilege change events, although detection of race condition exploitation can be difficult.

Compensating Controls: Ensure that third-party applications are sourced only from trusted repositories and maintain strict device management policies to minimize the risk of malicious applications being installed locally.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a high risk due to the potential for privilege escalation without user involvement. Administrators should prioritize the deployment of the December 2025 security bulletin to all managed Android devices. Maintaining current patch levels is the most effective strategy to mitigate this class of local security flaw.