Android Keyguard Service Delegate App Pinning Bypass Vulnerability

A vulnerability in the KeyguardServiceDelegate component allows a partial bypass of app pinning. This issue arises from a missing permission check in the onServiceDisconnected method, enabling limited interaction with other apps without knowledge of the Lock Screen Keyguard Flag (LSKF). The impact of this vulnerability varies by application, potentially leading to local information disclosure, without requiring additional execution privileges or user interaction for exploitation.

Impact

Exploitation of this vulnerability could result in unauthorized access to information from other applications, depending on the specific app and its data handling.