A race condition vulnerability in the Android UsbDataAdvancedProtectionHook component enables local elevation of privilege without requiring user interaction.

This vulnerability is a race condition within the UsbDataAdvancedProtectionHook.java file that permits unauthorized access to USB data when the device screen is in a locked or off state. An attacker with local access can exploit this flaw to achieve escalation of privileges without needing further execution permissions or user interaction.

The ability for a local attacker to escalate privileges and access sensitive USB data poses a significant threat to device integrity and user privacy. Given the CVSS score of 7.0, this vulnerability is classified as High severity, as it bypasses standard security protections intended to restrict USB access while the device is inactive. Unauthorized access to data on mobile devices can lead to the exposure of corporate credentials, proprietary information, and personal user data.

Immediate Action: Update the affected Android device to the version provided in the official Google security bulletin for Android 16-qpr2.

Proactive Monitoring: Review system logs for unusual USB connection events or unexpected authentication attempts occurring during periods of inactivity.

Compensating Controls: Ensure device policies restrict physical access to hardware and enforce strong full-disk encryption to limit the utility of local privilege escalation attempts.

Public Exploit Available: No

This vulnerability represents a significant local security weakness that could be leveraged by malicious actors with physical or local access to the device. Security teams should prioritize the deployment of the Android 16-qpr2 security update across all managed devices to remediate the flaw in the UsbDataAdvancedProtectionHook component. Prompt application of this patch is essential to maintain the security posture of the mobile environment.