Android MediaProvider SQL Injection Vulnerability in PickerDbFacade Allowing Unauthorized Data Access and Privilege Escalation

A SQL injection vulnerability has been identified in the Android MediaProvider component, specifically within the PickerDbFacade.java file. This issue allows for unauthorized data access and could lead to local privilege escalation, with no additional execution privileges required. The vulnerability can be exploited without user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to data and local privilege escalation on the affected device.

Remediation

Users can update their devices to the September 2025 security patch level to address this vulnerability.