Android Framework PackageParser Intent Handling Privilege Escalation Vulnerability

A vulnerability has been identified in the Android Framework's PackageParser component, specifically in the createIntentsList function. This issue arises from unsafe deserialization, which creates a potential bypass of lazy bundle hardening. As a result, modified data could be passed to the next process, leading to unauthorized privilege escalation. Notably, this vulnerability does not require any additional execution privileges and can be exploited without user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized local privilege escalation, allowing a user to gain elevated rights or access within the system.

Remediation

Users can update their devices to the June 2025 security patch level to address this vulnerability.