A high-severity local privilege escalation vulnerability in Google Android allows attackers to bypass consent mechanisms and gain elevated access without user interaction.

The flaw exists within the buildMiniResolver function of IntentForwarderActivity.java, where a tapjacking or overlay attack enables a consent bypass, allowing a local attacker with low privileges to escalate their access levels.

Successful exploitation grants an attacker local escalation of privileges, potentially resulting in unauthorized access to sensitive user data, modification of system configurations, or disruption of device services. With a CVSS score of 7.8, this vulnerability represents a significant risk to the integrity and confidentiality of the affected devices. Enterprises managing fleets of Android devices should prioritize this update to prevent unauthorized lateral movement or administrative control gain by malicious local applications.

Immediate Action: Apply the latest Android security patches provided by Google or the specific device manufacturer as soon as they become available.

Proactive Monitoring: Monitor device security logs for unusual overlay activity or signs of unauthorized privilege escalation attempts by installed applications.

Compensating Controls: Enforce strict application installation policies, such as prohibiting the sideloading of applications from untrusted sources, to reduce the likelihood of malicious apps gaining the foothold required for this attack.

Public Exploit Available: No

Given the potential for complete local privilege escalation, this vulnerability poses a severe risk to device integrity. Security teams should monitor the official Google Android Security Bulletin for the release of specific patches and deploy them across their device fleet with high urgency. Prioritize updating devices running versions 14 through 17 to mitigate the risk of unauthorized system-level access.