Technical impact
Multiple Android components can start a background activity without performing a permission check. The flaw allows a user‑owned application to launch privileged background tasks that run with higher privileges than the originating app, potentially compromising device security. The vulnerability requires no special user interaction, enabling a local attacker to elevate privileges by simply initiating the background activity.
Affected Systems
The flaw affects devices running Google Android versions 14.0, 15.0, 16.0, and the Android QPR2 release. Any installation running these OS versions prior to the fix is vulnerable.
Risk and Exploitability
The CVSS score is 7.8, indicating a high‑impact flaw. The EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Because no user interaction is needed, a local attacker can exploit it at any time. The impact is limited to the device, with no outbound network traffic required.
