A permissions bypass (CWE‑285) that allows an attacker to reset user‑selected permission configuration in several locations permits elevation of privileges from a regular user to a higher level without requiring any additional execution privileges (CWE‑693). This flaw represents a local privilege escalation (CWE‑862), giving the attacker broader control over device functions and data. No user interaction is necessary for exploitation, making it highly convenient for an adversary already present on the device.

The vulnerability affects Android devices produced or maintained by Google. Specific model or OS version information is not provided in the advisory, so all Android releases that contain the affected code paths should be considered at risk until a patch is applied.

The flaw has a CVSS score of 7.8 and is classified in the advisory as a local privilege escalation. Because the exploit does not require user interaction or elevated execution rights, it can be performed by any local attacker with access to the device. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, but the low EPSS score indicates a very low probability of exploitation at present.