1. Physical access to the device.
  2. Android version 10, 11, or 12 with security patch levels older than June 5, 2022.
  3. 3-button navigation via System>Accessibility>System Controls
  4. The lock screen must be enabled via Settings>Screen Lock for the target user profile
    a. Screen lock set to anything other than None.
  5. Enable the multi-user feature via Settings>System>Multiple Users
    a. Ensure there are at least two users defined and enabled.
    b. One user must have a screen lock setting configured and will serve as the target user.
    c. For easier exploitation, I recommend the second user be a simple guest account with no lock screen.
  1. While at the lock screen, expand the notification tray and click the user selection menu icon.
Expanded Notification Tray with User Selection Icon
User Selection in Notification Tray
Target User Shown in User Selection Menu
Target User Highlighter for Selection and Home Button Highlighted for Repetitive Input