A high-severity local privilege escalation vulnerability in Google Android allows an attacker to bypass permission consent dialogs without user interaction, potentially granting unauthorized system access.

The flaw resides in the parsePermissionGroup function of ParsedPermissionUtils.java, where a logic error enables an attacker to bypass security consent prompts. This vulnerability can be triggered by a local attacker without requiring additional execution privileges or user interaction.

The ability for a local attacker to escalate privileges to a higher level of authority poses a severe risk to device integrity and user data privacy. Given the CVSS score of 8.4, this vulnerability represents a significant threat to confidentiality, integrity, and availability, as it effectively removes the primary security barrier designed to protect sensitive system resources from malicious applications.

Immediate Action: Apply the March 2026 Android security updates provided by Google as soon as they are available for your specific device model or build.

Proactive Monitoring: Review device logs for unusual elevation attempts or unexpected modification of permission settings by installed applications.

Compensating Controls: Maintain strict adherence to installation policies that restrict side-loading of applications from untrusted sources, as the primary vector requires local access.

Public Exploit Available: No

This vulnerability presents a substantial risk to Android users by allowing malicious local code to bypass critical security consent mechanisms. Organizations and individual users should prioritize the deployment of the March 2026 Android security patch to mitigate the risk of local privilege escalation.