The vulnerability exists in the resumeConfigurationDispatch method of ActivityRecord.java and enables a background application launch in the absence of proper control logic. This flaw can grant a local attacker elevated privileges without requiring additional execution permissions or user interaction. The flaw is an example of a logic error that can be exploited for privilege escalation, potentially allowing the attacker to perform actions normally restricted to higher-privileged processes.

The affected products are Android systems provided by Google. No specific version information is supplied, so all Android installations that include the current ActivityRecord implementation are potentially vulnerable.

The CVE does not provide a CVSS score or EPSS value, but the lack of a user interaction requirement and the direct ability to gain higher privileges indicate a high risk to affected devices. The vulnerability is not listed in the CISA KEV catalog, yet its local nature means that any user with physical access can exploit it quickly.