A logic error in Android’s SettingsLib removes an essential permission check, allowing the same user to obtain elevated privileges without needing any execution privileges. The flaw permits any local user to execute privileged actions on the device, effectively compromising the integrity and confidentiality of system data. No user interaction beyond normal device usage is required for exploitation, making the attack extremely convenient for an attacker who is already logged on.

The vulnerability affects Google’s Android operating system, specifically the SettingsLib component that manages system settings. No particular Android version or build is specified in the available data, so all devices using the affected component are potentially at risk.

The vulnerability carries a CVSS score of 10.0, indicating maximum severity. Its EPSS score is below 1%, suggesting a low probability of widespread exploitation, yet the local nature of the attack and absence of user interaction make it a high‑impact risk for any compromised device. The flaw is not listed in CISA’s KEV catalog, but its critical score warrants urgency. Exploitation requires only local access; an attacker could rapidly elevate privileges on the device by triggering the affected component through normal user actions.