A logic error in the Android ComputerEngine.java code allows one user to access URLs that belong to another user without authentication or user interaction, representing a CWE-284: Improper Access Control weakness. This flaw enables a local attacker to elevate privileges on the same device without needing to execute additional code. The vulnerability is a pure privilege escalation, not requiring exploitation of a separate execution vector.

The flaw affects Google Android devices running versions 14.0, 15.0, and 16.0—including the 16.0 QPR2 beta releases—because those builds include the vulnerable ComputerEngine.java implementation. Any Android build prior to the official security patch that addresses this logic bug is potentially vulnerable.

The EPSS score is < 1% and KEV does not list this vulnerability, but the impact is moderate due to local privilege escalation. Because user interaction is not required, a local attacker—such as a malicious app or compromised user—can exploit it readily. Exploitation conditions are minimal, depending only on the presence of the vulnerable component, and the CVSS score of 7.8 indicates high severity. However, the low EPSS score of < 1% suggests the exploitation probability in the wild is currently low.