Executive brief
Android's cross-profile intent filter is a security mechanism that controls how apps communicate across different user profiles on a device. A logic error in the Android Framework allows attackers to bypass this filter and escalate privileges on a local device without needing special permissions or user interaction, potentially enabling unauthorized access to sensitive device functions.
Technical details
The vulnerability is a logic error in the Android Framework's cross-profile intent filter implementation that fails to properly validate intent routing between profiles. The flaw enables local privilege escalation (EoP) with no additional execution privileges required. As a local vulnerability with no user interaction prerequisite, an attacker with existing code execution on the device can exploit the intent filter bypass to escalate their access level. The vulnerability affects multiple Android versions and patches are available via AOSP commits referenced in the Android Security Bulletin for the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17 (patch 2026-09-05 and later)
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched