This vulnerability permits a primary Android user to disable secure NFC on other full users due to insufficient isolation between Android user profiles. The effect is a local privilege escalation, allowing the attacker to remove security protections for other users without needing additional execution privileges or user interaction.

The affected systems are devices running Android, as identified by Google. No specific affected versions were provided; therefore any Android installation that has not applied the necessary fix may be susceptible.

The flaw can be exploited locally on the device and does not require user interaction. An attacker who is the primary user can immediately disable secure NFC for other users, effectively escalating privileges. Because the vulnerability is local, it carries a high risk to the confidentiality and integrity of all user profiles on the device. Current EPSS data is unavailable and the vulnerability is not listed in CISA's KEV catalog, so the likelihood of exploitation in the wild cannot be quantified, but the potential impact warrants attention.