An improper input validation vulnerability in Zscaler Client Connector for Android and ChromeOS allows high-privileged attackers to bypass security controls, posing a significant risk to endpoint integrity.

This vulnerability involves improper input validation (CWE-20) within the Client Connector application. The CVSS vector (PR:H) indicates that successful exploitation requires an attacker to already possess high privileges on the host device.

The ability to bypass Zscaler security controls undermines the Zero Trust architecture of an organization. An attacker successfully exploiting this flaw could circumvent traffic inspection or policy enforcement, potentially leading to unauthorized data access or the introduction of malicious content into the corporate network. With a CVSS score of 8.1, this represents a high-severity risk to organizational security posture.

Immediate Action: Update Zscaler Client Connector for Android and ChromeOS to version 4.2.0.152 or later as documented in the vendor release summary.

Proactive Monitoring: Review endpoint logs for abnormal application behavior or unexpected connection patterns that deviate from established Zscaler policy configurations.

Compensating Controls: Ensure device management policies (MDM/UEM) are strictly enforced to limit the number of users with high-level privileges on mobile and ChromeOS endpoints.

Public Exploit Available: No — exploit_available (false).

Organizations utilizing Zscaler Client Connector on Android or ChromeOS platforms must prioritize upgrading to version 4.2.0.152. Given that this vulnerability allows for the circumvention of established security controls, delayed patching could leave endpoints vulnerable to advanced local threats. Apply the update across the fleet to ensure that security policies remain enforced and effective.