A high severity logic flaw in Google Android 17 permits an attacker to perform local privilege escalation and arbitrary code execution without user interaction.

This vulnerability is an elevation of privilege flaw located within the InCallController.java component. It allows a local attacker to execute arbitrary code with elevated permissions because the serviceClassExists function fails to properly validate inputs or state.

The ability for a local attacker to achieve arbitrary code execution and escalate privileges poses a significant risk to data confidentiality, integrity, and availability. With a CVSS score of 7.8, this vulnerability indicates that a compromised application or a malicious actor with local access could potentially gain full control over the device or bypass security sandbox restrictions. This could result in the theft of sensitive user data, unauthorized access to system resources, or persistent device compromise.

Immediate Action: Organizations and users should monitor the official Google Android Security Bulletin for the release of a security patch and apply it to all affected Android 17 devices immediately upon availability.

Proactive Monitoring: Security teams should monitor system logs for unusual process execution patterns or unexpected privilege escalation attempts originating from local applications.

Compensating Controls: Ensure that all applications installed on the device are sourced from trusted vendors and that Google Play Protect is enabled to detect potentially malicious behavior.

Public Exploit Available: Yes, public proof-of-concept repositories exist on GitHub.

Given the high severity of this vulnerability and the confirmed existence of public proof-of-concept code, immediate attention is required. Administrators should prioritize the deployment of the forthcoming security update from Google to mitigate the risk of local privilege escalation. Until a patch is deployed, exercise caution regarding the installation of third-party applications.