Android Settings SpaAppBridgeActivity Cross-User File Reveal Vulnerability Allowing Privilege Escalation

A logic error in the SpaAppBridgeActivity component of the Android Settings app could lead to a cross-user file reveal. This vulnerability allows for local escalation of privilege without requiring additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to files across different user profiles, potentially leading to unauthorized privilege escalation.

Remediation

Users can update their devices to the May 2025 security patch level to address this vulnerability.