The vulnerability is a cross‑user permission bypass caused by a confused deputy in the hasInteractAcrossUsersFullPermission method of AppInfoBase.java. An attacker can elevate privileges on a device by exploiting this flaw without needing any additional execution rights or user interaction. The impact is local privilege escalation that can lead to unauthorized access to other users' data or system functions, and it is classified as CWE‑441.

Affected devices run Google Android versions 14.0, 15.0, 16.0 and the associated preview betas (qpr2_beta_1 through qpr2_beta_3). These are all listed in the CPE strings provided. The flaw therefore covers the mainstream public releases of Android 14, 15, and 16 and their recent beta builds.

The CVSS score of 8.4 signals a high severity, while the EPSS score of <1 % indicates a very low current exploitation probability. The vulnerability is not yet in the CISA KEV catalog. Because the flaw can be exercised purely from local code, an attacker with a malicious app or a physically accessed device can bypass the permission boundary. Prompt patching is advised to mitigate the risk of privileged abuse.