In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4 | CVE-2025-0083 |
Exploitation
The vulnerability can be exploited by an attacker who can access the device locally. By leveraging URI double encoding, the attacker can potentially access sensitive information across different user profiles without requiring any special privileges or user interaction.
Affected Products
- Android Framework: Vulnerable to URI double encoding issues affecting user profile content access.
- Telecomm Services: May expose user data due to improper handling of URIs.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Android. Users should also ensure that their devices are configured to limit access to sensitive information across user profiles.