Android Download Provider Confused Deputy Vulnerability Allowing Information Disclosure

A vulnerability in the Android Download Provider has been identified, where user consent can be bypassed when opening files in shared storage. This issue arises from a confused deputy scenario, potentially leading to unauthorized local information disclosure. The vulnerability is present in the Download Provider component, specifically in the 'checkWhetherCallingAppHasAccess' function of 'DownloadProvider.java'. It affects several Android versions, including 12, 12L, 13, 14, and 15. Notably, this vulnerability does not require additional execution privileges or user interaction for exploitation.

Impact

Exploitation of this vulnerability could result in unauthorized local information disclosure.

Remediation

Users can update their devices to the March 2025 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.