Android Framework Input Method Session Key Event Injection Vulnerability Allowing Privilege Escalation

A vulnerability has been identified in the Android Framework's input method session management. Specifically, in the 'onInputEvent' function of 'IInputMethodSessionWrapper.java', an untrusted application can inject key and motion events into the default input method editor (IME). This issue arises from a lack of proper permission checks, potentially leading to unauthorized privilege escalation. Notably, exploitation of this vulnerability does not require any additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability allows for local escalation of privileges, enabling an application to gain unauthorized access to system resources or functions.

Remediation

Users can update their devices to the June 2025 security patch level to address this vulnerability.