Improper input validation in the setPackageOrComponentEnabled function of Android’s ManagedServices module can desynchronize notification policy state, allowing a local attacker to gain elevated privileges without requiring any existing execution rights. The flaw does not need user interaction and can be triggered by exploiting the notification policy desynchronization to manipulate internal system components.

This vulnerability affects Android operating systems 14.0, 15.0, and 16.0, including the three beta releases (16.0‑qpr2_beta_1, 16.0‑qpr2_beta_2, 16.0‑qpr2_beta_3).

The CVSS score of 8.4 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time; the flaw is not included in the CISA Known Exploited Vulnerabilities catalog. The attack vector is local, with no need for user interaction, meaning any user with access to the device could potentially exploit the flaw by invoking the vulnerable function through a malicious or compromised app.