the phone's kernel, or using a known Android exploit that has been patched in newer versions; by not upgrading the phone, or intentionally downgrading the version. Mitigation strategies Operating systems and users can use the following strategies to reduce the risk of privilege escalation: Data Execution Prevention Address space layout randomization (to make it harder for buffer overruns to execute privileged instructions at known addresses in memory) Running applications with least privilege (for example by running Internet Explorer with the Administrator SID disabled in the process token) in order to reduce the ability of buffer overrun exploits to abuse the privileges of an elevated user. Requiring kernel mode code to be digitally signed. Patching Use of compilers that trap buffer overruns Encryption of software and/or firmware components. Use of an operating system with Mandatory Access Controls (MAC) such as SELinux Horizontal Horizontal privilege escalation occurs when an application allows the attacker to gain access to resources which normally would have been protected from an application or user. The result is that the application performs actions with the same user but different security context than intended by the application developer or system administrator; this is effectively a limited form of privilege escalation (specifically, the unauthorized assumption of the capability of impersonating other users). Compared to the vertical privilege escalation, horizontal requires no upgrading the privilege of accounts. It often relies on the bugs in the system. Examples This problem often occurs in web applications. Consider the following example: User A has access to their own bank account in an Internet Banking application. User B has access to their own bank account in the same Internet Banking application. The vulnerability occurs when User A is able to access User B's bank account by performing some sort of malicious activity. This malicious activity may be possible due to common web application weaknesses or vulnerabilities. Potential web application vulnerabilities or situations that may lead to this condition include: Predictable session IDs in the user's HTTP cookie Session fixation Cross-site scripting Easily guessable passwords Theft or hijacking of session cookies Keystroke logging See also Defensive programming Hacking of consumer electronics Illegal number Principle of least privilege Privilege revocation (computing) Privilege separation Rooting (Android OS) Row hammer References Operating system security