Multiple Android components can start a background activity without performing a permission check. The flaw allows a user‑owned application to launch privileged background tasks that run with higher privileges than the originating app, potentially compromising device security. The vulnerability requires no special user interaction, enabling a local attacker to elevate privileges by simply initiating the background activity.

The flaw affects devices running Google Android. No specific version range is listed, so all installations prior to the fix are potentially vulnerable.

The CVSS score is 7.8, indicating a high‑impact flaw. The EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Because no user interaction is needed, a local attacker can exploit it at any time. The impact is limited to the device, with no outbound network traffic required.