In the verifySignature method of ApkChecksums.java, a resource exhaustion condition can be triggered, causing the system to crash. The vulnerability does not require elevated privileges and can be executed locally without user interaction. The resulting crash leads to a denial‑of‑service condition for the device, affecting application availability and potentially halting system services.

The flaw is present in Google Android devices. Exact version information is not provided in the advisory, but the issue is documented in the Android Security Bulletin for June 2026, indicating that devices running the affected Android build and not yet upgraded will be vulnerable. All affected Android platforms that have not applied the latest security patch may be impacted.

The exploitation scenario does not involve remote code execution or network interaction; an attacker must have local access or be able to influence the execution of a package that invokes verifySignature. The CVSS score of 5.5 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently in widespread use by attackers. Nonetheless, a local denial of service can severely disrupt device operation, making it a high‑priority issue for environments where stability is critical.