A high-severity local privilege escalation vulnerability in Google Android allows attackers to manipulate payment settings, potentially leading to unauthorized financial transactions.

The flaw resides in the onCreate function of PaymentDefaultDialog.java, where a confused deputy condition allows a local attacker with low privileges to escalate their authority and alter the default payment application settings without requiring user interaction.

The ability for a local attacker to escalate privileges and modify payment defaults poses a significant risk to financial integrity and data security. With a CVSS score of 7.8, this vulnerability carries a high risk of unauthorized financial activity and potential exfiltration of payment-related data, which could lead to substantial reputational damage and financial loss for affected users.

Immediate Action: Apply the latest security updates provided by Google or your device manufacturer as soon as they become available to address this privilege escalation flaw.

Proactive Monitoring: Monitor device logs for unauthorized changes to system settings or suspicious activity originating from payment-related applications.

Compensating Controls: Ensure that third-party security applications are active and that the device remains locked with strong authentication to restrict the local access required for this exploit.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a high-risk security flaw that facilitates the unauthorized modification of critical system settings. Security teams and individual users should prioritize the installation of vendor-supplied security patches for Android versions 15 through 17 to eliminate the underlying confused deputy condition and prevent potential local exploitation.