The vulnerability exists in the hasImage method of Android's Notification.java, where a permissions check can be bypassed. A malicious local application or user can read data belonging to another user, leading to local privilege escalation and the exposure of sensitive information. The flaw allows reading inter‑user data without any additional execution privileges and is classified as an information disclosure vulnerability, identified as CWE‑200.

Android 14.0, 15.0, and 16.0, including the qpr2 beta releases 1–3, provided by Google.

The CVSS score of 8.4 signals high severity, while the EPSS score of less than 1 % indicates that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local exploitation by a malicious app or user with sufficient permissions; user interaction is not required, as stated in the CVE description. This combination makes the flaw particularly dangerous for devices that remain unpatched.