A high-severity local privilege escalation vulnerability in Google Android could allow an attacker with local access to compromise the integrity and confidentiality of the system.

The vulnerability exists within the addCreatorToken function of ActivityManagerService.java due to a logic error that permits Intent Redirection. This flaw allows a local attacker with low privileges to escalate their permissions on the device without requiring user interaction.

Successful exploitation of this vulnerability results in a total loss of confidentiality, integrity, and availability for the affected device. With a CVSS score of 7.8, the potential for unauthorized privilege escalation poses a significant risk to organizational data security, particularly for mobile fleets or devices handling sensitive internal information.

Immediate Action: Users should apply the latest security updates provided by Google or their respective device manufacturer as soon as they become available.

Proactive Monitoring: Security teams should monitor device logs for unexpected process execution or suspicious activity originating from low-privileged applications.

Compensating Controls: Ensure that Mobile Device Management (MDM) policies restrict the installation of untrusted applications, as the attack vector requires a local presence on the device.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk of local privilege escalation that could be leveraged to bypass Android security boundaries. Organizations should prioritize the deployment of the September 2026 Android security patches to all managed devices to effectively mitigate this risk.