Android Connectivity Service Missing Permission Check Vulnerability Allowing Local Information Disclosure

A vulnerability exists in the Connectivity Service component of Android due to a missing permission check in the offerNetwork method. This oversight could allow an unauthorized application to intercept network requests by registering a network offer, thereby leaking sensitive information about other applications on the device. The vulnerability affects several Android versions and does not require additional execution privileges or user interaction for exploitation.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data from other applications on the device.

Remediation

Users can update their devices to the June 2025 security patch level to address this vulnerability.