Multiple Android components can start a background activity without performing a permission check. The flaw allows a user‑owned application to launch privileged background tasks that run with higher privileges than the originating app, potentially compromising device security. The vulnerability requires no special user interaction, enabling a local attacker to elevate privileges by simply initiating the background activity.

The flaw affects devices running Google Android versions 14.0, 15.0, 16.0, and the Android QPR2 beta releases qpr2_beta_1 through qpr2_beta_3. Any installation running these OS versions prior to the fix is vulnerable.

The CVSS score is 7.8, indicating a high‑impact flaw. The EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Because no user interaction is needed, a local attacker can exploit it at any time. The impact is limited to the device, with no outbound network traffic required.