Android Skia Out-of-Bounds Write Vulnerability in SkRegion Component Allowing Local Privilege Escalation

A vulnerability has been identified in the Skia graphics library used by Android, specifically within the 'resizeToAtLeast' function of 'SkRegion.cpp'. This issue arises from an integer overflow that leads to a potential out-of-bounds write. Exploitation of this vulnerability could result in local escalation of privileges, with no additional execution privileges required. Notably, user interaction is not necessary for exploitation. The vulnerability affects multiple Android versions, including 12, 12L, 13, 14, and 15.

Impact

Exploitation of this vulnerability could allow an attacker to gain elevated privileges on the affected device, potentially leading to unauthorized access or control over system resources or applications.

Remediation

Users can update their devices to the December 2024 security patch level to address this vulnerability.