A critical local privilege escalation vulnerability in Android versions 14, 15, and 16 allows unauthenticated attackers to delete media files without required permissions.

This vulnerability involves an intent redirection flaw that bypasses the MANAGE_EXTERNAL_STORAGE permission requirement. An attacker can trigger this issue locally without requiring any user interaction or additional execution privileges.

The ability for an unauthenticated local attacker to delete arbitrary media files poses a significant risk to data integrity and system security. With a CVSS score of 8.4, this vulnerability is classified as high severity because it enables local escalation of privilege, which could be leveraged to disrupt operations or facilitate further malicious activities on the affected device.

Immediate Action: Organizations should monitor the official Google Android Security Bulletin for the release of security patches and apply them to all managed devices immediately upon availability.

Proactive Monitoring: Security teams should review device access logs for unauthorized attempts to modify or delete media files and monitor for anomalous application behavior that may indicate exploitation.

Compensating Controls: Ensure that third party application permissions are strictly managed and that devices are configured to prevent the installation of untrusted applications, which limits the attack surface for local exploits.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for privilege escalation, this vulnerability represents a serious security concern for Android environments. Administrators must prioritize the deployment of relevant security updates as soon as Google provides them to ensure the integrity of the Android operating system and the data stored therein.