A missing permission check in Android’s NFC subsystem allows a malicious NFC tag to forge an NFC event. This spoofing can trigger privileged actions on the device without the attacker requiring additional execution capabilities or user interaction. The flaw enables a local attacker to elevate their privileges, potentially accessing or modifying system resources.

Android devices whose NFC implementation contains the unchecked permission logic, covering any Android version that ships with the affected NFC code. All affected devices should be treated as vulnerable until a patch is applied.

The CVSS score of 10 marks the vulnerability as critical. The EPSS score of less than 1% indicates that, while widespread exploitation is currently unlikely, the flaw remains a serious risk due to its local privilege escalation potential. It is not listed in the CISA KEV catalog, but user interaction is not required for exploitation – a malicious NFC tag can trigger the spoofed event automatically.