A critical local privilege escalation flaw in Google Android allows unauthorized access to work profile contacts via a confused deputy vulnerability.

The vulnerability resides in EditFdnContactScreen.java and is classified as an elevation of privilege flaw. The issue stems from a confused deputy mechanism that allows a local attacker with low privileges to leak sensitive contact information without requiring user interaction.

The ability for a local attacker to bypass security boundaries and access work profile data presents a significant risk to organizational confidentiality. Because the vulnerability allows for local escalation of privilege, an attacker could potentially gain unauthorized access to corporate contacts, leading to data breaches or further exploitation within the mobile environment. With a CVSS score of 7.8, this vulnerability represents a high-risk security gap that requires immediate attention to prevent unauthorized data exposure.

Immediate Action: Apply the December 2025 Android security updates provided by Google or your device manufacturer to patch the affected component.

Proactive Monitoring: Review system logs for unusual process activity or unauthorized attempts to access contact storage or inter-process communication services.

Compensating Controls: Ensure that work profiles are managed via a robust Mobile Device Management (MDM) solution that enforces strict application permission policies and restricts unauthorized local access.

Public Exploit Available: No

Given the high severity of this vulnerability and its potential to expose sensitive work profile data, administrators should prioritize the deployment of the December 2025 Android security bulletin across all enterprise-managed devices. Failure to patch allows local attackers to bypass standard Android security controls, making timely firmware updates the most effective strategy for mitigating this risk.