Android devices have a flaw in the KeyguardServiceDelegate component. When a service is disconnected, a missing permission check can allow an application to bypass expected pinning restrictions and interact with other applications without knowing the device’s login screen key field. This weakness is classified as an information exposure failure (CWE‑200) and can result in local information disclosure, depending on the target app. No extra execution privileges or user interaction are required for exploitation.

Vulnerable devices run Android 14.0, 15.0, and 16.0. The issue appears in the KeyguardServiceDelegate implementation across these releases and applies to all device builds of these OS versions that have not been updated to a patched release.

The CVSS score of 6.2 indicates moderate severity, and the EPSS score of less than one percent suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. An attacker can take advantage of the flaw locally by triggering a service disconnection; because no user interaction or elevated privileges are needed, the risk is confined to the device owner’s data and the applications present on the device.