A critical local privilege escalation vulnerability in Android 13 and 14 allows an attacker to bypass security restrictions and launch activities from the background.

The vulnerability exists within the startNextMatchingActivity function of the ActivityTaskManagerService, where a logic error permits background activity launching. An attacker with low privileges can trigger this flaw to achieve elevated system control without requiring user interaction.

Successful exploitation grants an attacker local privilege escalation, which could lead to full system compromise, unauthorized data access, and the execution of arbitrary commands with elevated permissions. With a CVSS score of 7.8, this vulnerability poses a significant risk to the integrity and confidentiality of sensitive user data stored on affected mobile devices.

Immediate Action: Update affected Android devices to the latest security patch level provided by the manufacturer as specified in the December 2025 Android Security Bulletin.

Proactive Monitoring: Security teams should monitor device logs for unexpected background activity launches or abnormal system behavior that may indicate an attempt to exploit the ActivityTaskManagerService.

Compensating Controls: Ensure that all applications are restricted by the Android permission model and avoid installing applications from untrusted sources, as the exploit requires local access to the device.

Public Exploit Available: Unknown.

Given the potential for complete system compromise and the ease of exploitation once an attacker has local access, users and administrators must prioritize the application of the December 2025 security updates. Organizations managing fleets of Android devices should verify that all endpoints have successfully ingested the patch to mitigate this privilege escalation risk.