Local privilege escalation via swallowed parcel exception

Privilege escalation in Android 9, 10, and 11 allows local users to gain additional permissions through a crafted parcel without interaction. OutputConfiguration.createFromParcel catches a deserialization exception and returns after consuming only part of the data emitted by writeToParcel, causing the enclosing object to read attacker-controlled trailing bytes at the wrong offset. An installed malicious application can exploit the mismatch during intent delivery to alter trusted component metadata and execute code in a more privileged app.