PermissionManagerServiceImpl.java contains a logic error in its removePermission routine that permits an application to override any system permission. The flaw can be exploited to grant elevated privileges without additional execution rights, and requires user interaction, making it a local attack that depends on the victim’s device being accessed or an app being granted permissions.

Google Android 14.0 is the affected product. Devices running this version are potentially vulnerable; earlier Android releases are not listed as affected.

The vulnerability scores a CVSS of 7.8, indicating high severity, but the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. It is not listed in the KEV catalog and requires direct user interaction, meaning the flaw is a local privilege escalation vector that can compromise device security if an attacker gains physical or user‑based access.