Samsung DeviceIdService Improper Intent Verification Vulnerability Allowing OAID Reset

A vulnerability exists in the DeviceIdService prior to the SMR April 2025 Release 1, where improper verification of intent by the broadcast receiver allows local attackers to reset the Open Anonymous Identifier (OAID). This issue affects select devices running Android 13, 14, and 15.

Impact

Exploitation of this vulnerability allows local attackers to reset the Open Anonymous Identifier (OAID), potentially disrupting applications or services that rely on this identifier for tracking or identification purposes.

Remediation

Users can apply the SMR April 2025 Release 1 update to address this vulnerability.