Android Framework Denial-of-Service Vulnerability in Recovery System

A denial-of-service vulnerability has been identified in the Android Framework's RecoverySystem component. The issue arises in the rebootWipeUserData function, where a missing permission check allows for a factory reset of the device while in Device Specific User (DSU) mode. This vulnerability can be exploited without any additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability leads to a physical denial-of-service, causing the device to become unresponsive or unavailable for use.

Remediation

Users can update their devices to the December 2025 security patch level to address this vulnerability.