A logic error in the Android ComputerEngine.java code allows one user to access URLs that belong to another user without authentication or user interaction, representing a CWE-284: Improper Access Control weakness. This flaw enables a local attacker to elevate privileges on the same device without needing to execute additional code. The vulnerability is a pure privilege escalation, not requiring exploitation of a separate execution vector.

The flaw affects Android devices that include the vulnerable ComputerEngine.java implementation. No specific OS version is listed, meaning any Android build containing this code prior to an official fix is potentially compromised.

The EPSS score is < 1% and KEV does not list this vulnerability, but the impact is moderate due to local privilege escalation. Because user interaction is not required, a local attacker—such as a malicious app or compromised user—can exploit it readily. Exploitation conditions are minimal, depending only on the presence of the vulnerable component, and the CVSS score of 5.9 indicates moderate severity. However, the low EPSS score of < 1% suggests the exploitation probability in the wild is currently low.