The vulnerability originates from a logic flaw in the KeyguardViewMediator component of the Android operating system that allows an attacker to bypass the lockdown mode enforced by screen pinning. Based on the description, it is inferred that the attack vector is local. Because the flaw can be exploited locally without additional execution privileges and does not require user interaction, a local attacker can reveal sensitive data that should normally remain hidden when lockdown mode is active. This constitutes a local information disclosure vulnerability.

Google’s Android platform is affected. The flaw is present in KeyguardViewMediator across all Android releases covered by the provided CPEs – Android 14.0, 15.0, 16.0 and the 16.0 qpr2 beta series – until the vendor releases a patch that corrects the logic error. All devices running these OS versions should be considered potentially vulnerable.

Based on the description, it is inferred that the attack vector is local, and the attack does not require user interaction. The EPSS value of less than 1% and the absence from CISA’s KEV catalog suggest that exploitation is currently rare, but the low CVSS score of 3.3 indicates only a modest impact per the scoring system. Nevertheless, because the attack does not require privilege escalation, any compromised device could suffer local information disclosure if the attacker gains basic user access.