In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "length": 521.0, "function_hash": "32414286177644942268403516437821016494" }, "id": "ASB-A-232799171-6c862984", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/433ba102f30f0ab07e8ac0ff721ce97610eff030", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java", "function": "RemoteSpeechRecognitionService" }, "signature_type": "Function" }, { "match_only_versions": [ "15-next" ], "digest": { "threshold": 0.9, "line_hashes": [ "288935220782293332190895425602160771", "63340962172322500513400919318468543498", "3179311920931092807603071297423160969", "324406239039629891657717983469868163253", "90179310622828671009594517766863886928" ] }, "id": "ASB-A-232799171-9060b81d", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/433ba102f30f0ab07e8ac0ff721ce97610eff030", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/433ba102f30f0ab07e8ac0ff721ce97610eff030" ], "spl": "2025-05-01", "severity": "High", "types": [ "EoP" ] }
{ "vanir_signatures": [ { "match_only_versions": [ "13" ], "digest": { "length": 515.0, "function_hash": "91465346211056328279693732571683506792" }, "id": "ASB-A-232799171-855e19de", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/0584ff4e5bc1b051ed38268c108623b2139d0784", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java", "function": "RemoteSpeechRecognitionService" }, "signature_type": "Function" }, { "match_only_versions": [ "13" ], "digest": { "threshold": 0.9, "line_hashes": [ "288935220782293332190895425602160771", "63340962172322500513400919318468543498", "3179311920931092807603071297423160969", "324406239039629891657717983469868163253", "90179310622828671009594517766863886928" ] }, "id": "ASB-A-232799171-c821b834", "source": "https://googleplex-android.googlesource.com/platform/frameworks/base/+/0584ff4e5bc1b051ed38268c108623b2139d0784", "deprecated": false, "signature_version": "v1", "target": { "file": "services/core/java/com/android/server/speech/RemoteSpeechRecognitionService.java" }, "signature_type": "Line" } ], "fixes": [ "https://android.googlesource.com/platform/frameworks/base/+/0584ff4e5bc1b051ed38268c108623b2139d0784" ], "spl": "2025-05-01", "severity": "High", "types": [ "EoP" ] }