The vulnerability involves a confused‑deputy scenario in the PipTaskOrganizer component of Android, allowing an application to launch an activity from the background without user interaction. This misuse permits a local attacker to gain higher privileges on the device, representing an improper access control flaw (CWE-441) and a confused‑deputy flaw (CWE-441) that can be exploited without additional privileges.

The defect is present in Google Android systems that include the PipTaskOrganizer module; specific version details are not disclosed. All affected Android installations that contain this component are susceptible until patched.

This vulnerability has a CVSS score of 7.8, indicating high severity. Exploitation is feasible locally on the device and requires no user interaction, making it a high‑risk privilege escalation. EPSS score of <1% and the vulnerability is not listed in the CISA KEV catalog, but the lack of a need for remote access or an exploit payload increases its potential impact for an adversary with physical or local access.