Android Domain Verification Service Logic Error Vulnerability Allowing App Link Hijacking

A logic error has been identified in the Domain Verification Service component of Android, specifically within the approvalLevelForDomainInternal function. This vulnerability creates a potential for hijacking arbitrary app links, leading to unauthorized escalation of privileges. Notably, exploitation of this issue does not require any additional execution privileges or user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized escalation of privileges, allowing a user to gain elevated rights or access within the application or system.

Remediation

Users can update their devices to the June 2026 security patch level to address this vulnerability. Instructions for checking and updating the Android version are available on the Google Support website.