The vulnerability exists in the validateNode function within ResourceTypes.cpp, where an incorrect bounds check allows an out‑of‑bounds read. This flaw can be exploited to gain elevated privileges on the device without requiring any additional execution privileges. The impact is a local privilege escalation that could allow a malicious app or user to perform actions normally restricted to higher‑privileged components.

This flaw affects Google Android devices. No specific Android versions are enumerated in the CNA data, but the issue resides in the source code referenced by the Android security bulletin for 2026‑06‑01.

The exploit requires only local access and does not require user interaction or network connectivity. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the nature of the flaw suggests a high severity risk for affected devices. An attacker who can run code locally may read protected memory and elevate privileges, potentially leading to full system compromise. The lack of publicly reported exploits does not reduce the inherent risk associated with such a flaw.