In Android’s notification framework, the method responsible for hiding sensitive data in expandable notifications contains a logic flaw that can leak a contact name. This defect allows an attacker to retrieve the name of a contact displayed in a notification without needing any privileges beyond those granted to ordinary applications or the user. The vulnerability does not permit further exploitation or privilege escalation; it merely exposes personal information that could be sensitive to the user.

The flaw affects Google Android releases from version 14.0 onward, including 15.0 and 16.0 and any subsequent builds that include the unpatched notification code.

The CVSS score of 6.2 indicates a moderate impact. The exploit probability is very low, with an EPSS score of less than 1%, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is local; the victim must have the device to view the notification. Because no user interaction is required beyond normal notification viewing, any authorized user could inadvertently expose contact names.