A critical local privilege escalation vulnerability in the Android PrintManagerService could allow unauthorized access to sensitive user data and system control.

The vulnerability exists within the validateIconUserBoundary function of PrintManagerService.java, where a confused deputy flaw enables local information disclosure and potential privilege escalation without requiring user interaction.

The exploitation of this vulnerability poses a severe risk to data confidentiality and system integrity. Because it allows for local escalation of privilege, an attacker with low-level access can gain elevated control over the device, potentially compromising sensitive user information and bypassing standard security boundaries. Given the CVSS score of 7.8, this flaw represents a significant risk to organizational mobility security and data protection standards.

Immediate Action: Apply the official December 2025 Android security updates provided by Google to all affected devices.

Proactive Monitoring: Monitor system logs for unusual activity related to the PrintManagerService or unexpected application behavior indicative of attempted privilege escalation.

Compensating Controls: Ensure that enterprise mobile device management (MDM) policies are strictly enforced to limit the installation of untrusted or unauthorized applications that could serve as a vector for local exploitation.

Public Exploit Available: No

Given the potential for local privilege escalation, this vulnerability should be prioritized within your patch management cycle. Security administrators must ensure that the December 2025 Android security bulletin updates are deployed across all managed devices immediately to eliminate this risk.