Android PhoneWindowManager Lock Screen Bypass Vulnerability Allowing Privilege Escalation

A logic error in the PhoneWindowManager component can lead to a lock screen bypass, allowing unauthorized access to the settings app. This vulnerability enables local privilege escalation without requiring additional execution privileges or user interaction. It affects several Android versions, including 13, 14, and 15.

Impact

Exploitation of this vulnerability could result in unauthorized access to the settings app while the device is locked, potentially allowing changes to system settings or other privileged actions.

Remediation

Users can update their devices to the April 2025 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.