Android Framework ResourcesImpl Confused Deputy Vulnerability Allowing Unauthorized Access to Task Snapshots

A vulnerability exists in the Android framework's ResourcesImpl component, specifically in the loadDrawableForCookie function. This issue arises from a confused deputy problem, which creates a potential avenue for unauthorized access to task snapshots of other applications. Exploitation of this vulnerability could lead to local privilege escalation, requiring no additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability allows for local escalation of privilege, enabling a user to gain unauthorized access to elevated rights or permissions within the system.

Remediation

Users can update their devices to the June 2025 security patch level to address this vulnerability.