Android XR Input Method Manager Service Privilege Escalation Vulnerability

A vulnerability has been identified in the Input Method Manager Service of Android XR, specifically in the addInputMethodListener function. This vulnerability arises from a missing permission check, which could allow unauthorized access to input text without the necessary permissions. The issue could lead to local privilege escalation, and can be exploited without any additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized access to input text, potentially allowing for local privilege escalation.

Remediation

To address this vulnerability, users should update their devices to the June 2026 security patch level or later. Instructions for checking and installing security updates can be found on the Google device update schedule page.