Executive brief
Android devices use intent filters to control how apps can communicate with system components and each other. This vulnerability allows a local attacker to bypass intent filter restrictions through a race condition, gaining the ability to escalate their privileges on the device without any special permissions or user interaction required.
Technical details
An intent filter bypass vulnerability exists in the Android Framework due to a race condition in multiple locations. The vulnerability allows local privilege escalation without requiring additional execution privileges or user interaction. The race condition creates a window where an attacker can manipulate intent filter logic to bypass security restrictions. This flaw affects Android Framework components and has been patched in AOSP versions 14, 15, 16, 16-qpr2, and 17 according to security patch level 2026-09-05.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2025-12-08: disclosed: CVE-2025-48564 published
- 2026-09-05: patched: Security patch level 2026-09-05 addresses this issue in AOSP