Android Settings SpaActivity Cross-User Permission Bypass Vulnerability Allowing Privilege Escalation

A logic error in the Android Settings application, specifically in the SpaActivity component, has introduced a cross-user permission bypass vulnerability. This issue allows for local escalation of privileges without requiring additional execution rights or user interaction. The vulnerability is present in the Android Open Source Project (AOSP) versions 14 and 15.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user to gain elevated rights or access beyond their current permissions.

Remediation

Users can update to the latest version of Android that includes the September 2025 security patch to address this vulnerability.