Android Framework Voicemail Work Profile Contact Leak Vulnerability Allowing Privilege Escalation

A vulnerability has been identified in the Android Framework's VoicemailSettingsActivity. This issue involves a potential leak of work profile contact numbers, attributed to a confused deputy problem. Exploiting this vulnerability could lead to unauthorized privilege escalation, with no additional execution rights required. Notably, user interaction is not necessary for exploitation.

Impact

Exploitation of this vulnerability could result in unauthorized elevation of privileges, allowing a user to gain higher access rights than intended.

Remediation

Users can update their devices to the September 2025 security patch level to address this vulnerability.