Android Framework Cross-User Image Leak Vulnerability in Avatar Picker

A vulnerability allowing cross-user image leaks has been identified in the Android Framework's avatar picker feature, specifically within the EditUserPhotoController.java file. This issue arises from a confused deputy problem, potentially leading to unauthorized local information disclosure. The vulnerability does not require additional execution privileges or user interaction for exploitation.

Impact

Exploitation of this vulnerability could result in unauthorized cross-user image leaks, allowing one user to access another user's images.

Remediation

Users can update their devices to the April 2025 security patch level to address this vulnerability.