In Android’s DisableSupervisionActivity.kt, a missing null check allows an app or process to call the activity’s onCreate and delete the device’s supervision data without proper authorization. Removing this data removes critical device‑supervision controls and grants the attacker elevated privileges within the management context, compromising confidentiality, integrity, and availability of the supervised state. The flaw only requires local access and does not need additional execution privileges.

Android OS on devices manufactured by Google. The vulnerability exists in the DisableSupervisionActivity.kt component, which is part of the system image. No specific version numbers are identified in the advisory, so all builds containing this component are potentially affected.

The CVSS score of 6.8 marks this issue as medium severity. With an EPSS score of less than 1 % the likelihood of real‑world exploitation appears low, and CISA has not listed it in its KEV catalog. Exfiltration or escalation typically requires a local user or process to launch or trigger the activity, but no user interaction is needed; once a malicious component can invoke the activity, it can delete the supervision data without further privileges.