Android DocumentsUI Scoped Storage Bypass Vulnerability Allowing Privilege Escalation

A vulnerability in the Android DocumentsUI application, specifically in the ActionHandler component, allows for a bypass of scoped storage restrictions between apps. This issue arises from a missing permission check, which could lead to unauthorized access to files. Exploitation of this vulnerability could result in local privilege escalation, with no additional execution privileges required. However, user interaction is necessary for exploitation.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files, allowing for local privilege escalation on the affected device.

Remediation

Users can update their devices to the April 2025 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.