A flaw in Android's parsePermissionGroup function enables an attacker to bypass the consent dialog for permissions, allowing local privilege escalation without requiring any user interaction or additional code execution. The vulnerability stems from improper restriction of permissions (CWE‑639) and can be exploited by locally running code to obtain elevated privileges over the device.

Affected platforms include Google Android operating systems 14.0, 15.0, 16.0, and the 16.0 QPR2 beta releases 1 through 3, as identified by the listed CPEs.

The CVSS score of 8.4 indicates a high severity vulnerability, while the EPSS score of less than 1% implies a low current exploitation likelihood. Exploitation requires only local access to the device, and does not need user interaction, enabling attackers to elevate privileges and potentially access or control sensitive data. The vulnerability is not yet cataloged in CISA's KEV, suggesting it may not be widely exploited in the open.