Android 15 -OS Leaks

Here is key List of android 15 leaks

1. EngageLab SDK Intent Redirection (CVE disclosed April 2026)

This is the most significant recent one. Microsoft discovered a severe intent redirection vulnerability in the widely used EngageLab SDK that allows apps on the same device to bypass Android’s security sandbox and gain unauthorized access to private data. Microsoft A malicious app crafts an intent with a URI in the extra field; the vulnerable app processes it and, due to the URI_ALLOW_UNSAFE flag, grants persistent read/write access to its own content provider — exposing its internal directories. Microsoft It was patched in EngageLab SDK v5.2.1 (November 2025).

2. CVE-2025–48633 — Framework Information Disclosure (Dec 2025)

This flaw in the Android Framework was rated high severity and is under active, targeted exploitation. One assessment suggests it stems from improper input validation that could let a local application gain access to sensitive information. Malwarebytes It affects Android 13–15 and was patched in the December 2025 security bulletin.

3. CVE-2025–48572 — Framework Arbitrary Code Execution (Dec 2025)

This vulnerability (CVSS 7.4) exists due to improper input validation in the Framework component, allowing a local application to execute arbitrary code. Attackers would need to trick a user into installing a malicious app that could then access sensitive data. Malwarebytes

4. CVE-2025–27363 — FreeType RCE

This FreeType library remote code execution vulnerability, discovered by Facebook researchers and actively exploited since March 2025 (CVSS 8.1), affects font rendering across multiple Android versions. Medium

5. Framework Elevation of Privilege (Ongoing Class)

Framework vulnerabilities represent 43.8% of total Android security flaws, primarily consisting of elevation of privilege attacks that allow malicious applications to gain unauthorized system access — including intent handling flaws where malicious apps intercept system communications.

Below gives overview( learning purpose only)

Get Mohammad Muddasir’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

1. Intent Redirection (EngageLab-style)

• Never set activities as exported=true unless necessary
• Validate and sanitize all incoming intent data
• Avoid using URI_ALLOW_UNSAFE flag
• Audit every third-party SDK you include — they inherit your app’s permissions

2. Information Disclosure via Framework flaws

• Keep your app’s targetSdkVersion updated
• Don’t store sensitive data in locations accessible via content providers unless properly permission-gated
• Use Android Keystore for secrets, not SharedPreferences or plain files

3. Elevation of Privilege / Tapjacking

• Set filterTouchesWhenObscured=true on sensitive UI elements
• Validate permissions at runtime, not just at install time

4. General hardening

• Run your app through MobSF (Mobile Security Framework) — a free static/dynamic analysis tool
• Follow the OWASP Mobile Top 10 checklist
• Use Android Lint security checks during development