Android Intent Resolver Cross-Profile Intent Filter Bypass Vulnerability Allowing Privilege Escalation

A logic error in the Android framework's intent handling can lead to a cross-profile intent filter bypass. This vulnerability allows for local privilege escalation without requiring additional execution privileges or user interaction. It affects multiple versions of the Android framework.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user or application to gain elevated rights or access within the system.

Reproduction

The vulnerability can be reproduced by forwarding an intent that declares its own type, allowing it to bypass cross-profile intent filters. This can be done using the IntentForwarderActivity, which has been updated to use the resolveActivityAsUserForExplicitType API to prevent double-checking the intent's type.

Remediation

Users can update to the December 2025 security patch level to address this vulnerability.