In the setupLayout method of PickActivity.java, a confused‑deputy flaw permits any application to start an activity as the DocumentsUI app without the need for additional execution privileges or user interaction. This flaw allows an attacker to execute arbitrary code with the higher permissions granted to the DocumentsUI context, effectively enabling a local escalation of privilege. The weakness is classified as CWE‑441: Confused Deputy.

The vulnerability affects Android operating systems 14.0, 15.0, and 16.0, as identified by the associated CPE strings. All devices running these Android releases are potentially impacted until the security patch is applied.

The CVSS score of 8.4 indicates a high severity vulnerability, however its EPSS score of less than 1 % shows a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is local and requires no user interaction; a malicious or compromised local application can trigger the flaw and gain higher privileges. The overall risk remains elevated due to the severity and the lack of user‑side defenses, but the likelihood of active exploitation is still low.