A high-severity local privilege escalation vulnerability in Google Android allows attackers to gain unauthorized system permissions without user interaction.

The vulnerability exists in the onActivityResult function of AppWidgetConfigActivityProxy.java, where a confused deputy flaw permits an unauthorized URI permission grant. This allows a local attacker with low-level privileges to escalate their access level without requiring user interaction.

Successful exploitation of this flaw grants an attacker elevated local privileges, potentially leading to full control over sensitive user data, system settings, or installed applications. With a CVSS score of 7.8, this vulnerability poses a significant risk to the integrity and confidentiality of the mobile device. Organizations should prioritize this issue to prevent unauthorized access that could compromise corporate data stored on mobile endpoints.

Immediate Action: Apply the latest security updates provided by Google or your device manufacturer to patch the affected Android versions.

Proactive Monitoring: Monitor device logs for anomalous activity or unauthorized permission requests originating from local applications.

Compensating Controls: Enforce strict mobile device management (MDM) policies to restrict the installation of untrusted applications and ensure that devices are running the latest security patches.

Public Exploit Available: No

Given the ability to achieve local privilege escalation without user interaction, this vulnerability represents a serious risk to mobile security. Administrators must ensure that all devices running the affected versions of Android are updated as soon as the vendor releases the corresponding security patch. Prioritize patching on devices that handle sensitive business data or have broad access to internal network resources.