A logic error in enableSystemPackageLPw within Settings.java can prevent location access from functioning, resulting in a local privilege escalation flaw. The vulnerability allows a local attacker to gain administrative privileges without requiring additional execution privileges or user interaction.

Google Android devices running Android versions 14.0, 15.0, and 16.0—including the qpr2_beta variants—may be affected.

The CVSS base score of 8.4 signals high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers need only local access and no user interaction or remote code execution to exploit the flaw, which can elevate privileges to privileged system mode.