The vulnerability resides in the createSessionInternal method of PackageInstallerService.java, where a missing permission check allows an application to change its own ownership. This omission can enable a local privilege escalation, granting the application elevated privileges without requiring any additional execution capabilities. The flaw does not need user interaction, meaning a malicious app can exploit it silently on the device.

Android operating systems from version 14.0 onwards, including 14.0, 15.0, 16.0, and the 16.0 qpr2 beta 1, beta 2, and beta 3 releases, are affected across devices manufactured by Google and devices using the Android platform.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% shows a low current exploitation probability. The flaw is not listed in CISA's KEV catalog. An attacker can exploit the issue from any local application on the device, using the missing permission check to gain higher-level privileges. Because no user interaction is required, the attack vector is local and the impact is confined to the device owner’s environment.