In addAllPermissions of PermissionManagerService.java there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITY_RECOGNITION permission without user confirmation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10; Android ID: A-154505240.