The reported flaw occurs in the dumpBitmapsProto method of ActivityManagerService.java. A missing permission check allows any installed application to invoke the method and retrieve bitmap data that should otherwise be private. Because the method can be called without full user consent or elevated execution rights, the vulnerability can lead to local privilege escalation, exposing sensitive information such as screenshots or cached images from other applications.

This issue affects Android operating system version 16.0 in the qpr2 beta releases 1, 2, and 3. Devices running these builds are susceptible to the exploit.

The vulnerability carries a CVSS base score of 8.4, indicating high severity, but the EPSS score is less than 1%, suggesting a low likelihood of current exploitation. There is no listing in CISA's KEV catalog, meaning no known active exploit out there. An attacker with a malicious application on the device can directly invoke the vulnerable method, as no additional execution privileges or user interaction are required. The impact is local escalation, allowing the attacker to read private data from other apps.