Executive brief
Android's SlicePermissionActivity contains a permission bypass vulnerability that allows a malicious app to escalate privileges on a device without requiring the user to take any action. This could enable an attacker to access sensitive device functions and data that should be restricted by the platform's permission system, potentially compromising the entire device.
Technical details
The vulnerability is a confused deputy attack in the onCreate method of SlicePermissionActivity.java in Android's Framework component. An attacker can bypass permission checks through a local attack vector that requires no additional execution privileges. The issue allows privilege escalation without user interaction, suggesting the permission validation logic fails to properly verify the caller's identity or authorization. Patches are available in Android versions 14, 15, 16, 16-qpr2, and 17 as of the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue