A missing permission check in the MediaProvider component of Android allows an application to query the location of media files via the content resolver. Because no authorization is enforced, local attackers can disclose the file paths of media stored on the device without requiring additional execution privileges or user interaction.

The vulnerability affects Google Android releases 14, 15, and 16, including the standard 16.0 release and the pre‑release builds qpr2 beta 1, beta 2, and beta 3.

The CVSS score of 4 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. Although the vulnerability is not listed in the CISA KEV catalog, it can be exploited by a local privilege universe, such as any process running on the device, to glean media file locations. No additional privileges or user interaction are required, so an attacker could obtain location information by simply invoking the affected content resolver API from a malicious application or script running on the device.