Android Telephony Framework Voicemail Ringtone URI Cross-User Data Leak Vulnerability

A cross-user data leak vulnerability has been identified in the Android Telephony framework, specifically within the VoicemailNotificationSettingsUtil component. This issue arises from a confused deputy scenario, allowing local information disclosure without requiring additional execution privileges or user interaction. The vulnerability exists in Android versions 13, 14, 15, and 16.

Impact

Exploitation of this vulnerability could lead to unauthorized access to voicemail notification settings across different user profiles, potentially allowing a malicious app to intercept or manipulate voicemail notification sounds.

Remediation

Users can update their devices to the September 2025 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.