The vulnerability resides in several functions of WindowState.java where a crafted overlay or tapjacking attack can mislead a user into accepting a permission. The attack does not require any user interaction beyond the deceptive overlay, meaning an attacker can elevate local privileges without explicit cooperation. The consequence is that the victim can gain higher privilege on the device, potentially accessing sensitive data or modifying system configurations.

This flaw affects the Android operating system distributed by Google. No specific version identifiers are listed in the data, so any Android release that incorporates the affected functions of WindowState.java is potentially vulnerable.

The EPSS score of <1% and its absence from the CISA KEV catalog indicate no confirmed public exploitation yet. However, the flaw carries high risk due to its local privilege escalation impact and the lack of user interaction needed. The likely attack vector is an overlay or tapjacking GUI that traps a user or activates a permission dialog through deceptive means, exploiting how the system handles permission prompts.