A critical logic error in Google Android allows local attackers to elevate privileges without requiring user interaction or elevated permissions.

The vulnerability stems from a logic error in the cross profile intent filter, which fails to correctly validate intent boundaries. This flaw permits a local, low-privileged attacker to achieve full escalation of privilege.

The ability for a local attacker to elevate privileges poses a severe risk to device integrity and user data confidentiality. Given the CVSS score of 7.8, this vulnerability is classified as High severity, as it enables unauthorized access to restricted system functions and sensitive data that would otherwise be protected by the operating system security model.

Immediate Action: Apply the December 2025 Android security updates provided by Google or your specific device manufacturer.

Proactive Monitoring: Security teams should monitor device logs for unexpected intent resolution errors or anomalous system calls originating from untrusted local applications.

Compensating Controls: Ensure that Google Play Protect is enabled on all enterprise-managed devices to assist in detecting malicious applications that might attempt to leverage such local exploits.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for Android ecosystems due to the potential for full privilege escalation without user interaction. It is imperative that administrators prioritize the deployment of the December 2025 security patches across all supported Android versions (13 through 16) to neutralize the threat of local exploitation.