Android WindowState onCreate Local Privilege Escalation
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An attacker with a basic user account, with local access to the host, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
To reduce immediate risk, ensure all non-essential applications are uninstalled and limit the installation of apps from untrusted sources. Implement robust endpoint detection and response (EDR) solutions to monitor for unusual process activity or unauthorized privilege changes. While direct configuration hardening is limited for this specific local vulnerability, strict adherence to a principle of least privilege for installed applications is advised.
The permanent resolution requires applying the vendor-provided security update that specifically addresses the logic error in `onCreate` of `WindowState.java`. Users should update their Android devices to the latest available security patch level as soon as it is released by their device manufacturer or service provider. This update will contain the fix to prevent the background activity launch and subsequent privilege escalation.
An attacker can exploit a logic error to launch a background activity, leading to local escalation of privilege on affected Android devices. This allows an unprivileged local attacker to gain higher system permissions without user interaction or additional execution privileges. The compromise could lead to unauthorized access to sensitive data, system modification, or further device takeover, severely impacting device integrity and user privacy.
Other CVEs affecting android
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.