Local privilege escalation via uncleared Parcel cookies

Privilege escalation in the Framework component of Android 12L allows local users to start a foreground activity from the background. Parcel.recycle returns objects to the reuse pool without clearing mClassCookies, allowing a later Parcel user to inherit stale class-cookie state and bypass the activity-start permission restriction. Exploitation requires a local low-privileged application but no user interaction; the demonstrated consequence is an unauthorized foreground activity launch.