The flaw is a permission bypass that allows an attacker with local access to reset the permissions users have logically granted to applications. Because the flaw is classified as CWE‑693, it exposes the user to a local privilege escalation without any need for additional execution privileges. This means a normal user of the device can, without user interaction, elevate their privileges and potentially take control of device settings and data.

Android devices maintained by Google are affected. Since the advisory does not specify particular OS versions or device models, all versions that contain the vulnerable code paths should be treated as at risk until a patch is applied.

The vulnerability scores a CVSS of 7.8, indicating high severity, and an EPSS of less than 1%, which is a low probability of exploitation at the present moment. Because no user interaction is required, any local attacker can exploit the flaw in the same way that an attacker who has already accessed the device could. The flaw is not listed in the CISA KEV catalog, but the lack of user interaction still makes it a significant concern for devices that are in the physical possession of an adversary.