Technical impact
The vulnerability resides in the NfcDispatcher.java of the Android operating system, where an insecure default value allows tryStartActivity to automatically assign a special app access permission. This flaw permits a local attacker to elevate privileges without requiring any additional execution rights or user interaction. The consequence is that a malicious application or user can gain privileged access to system resources by abusing the NFC service. The weakness corresponds to missing permission checks for special app access assignment (CWE-453).
Affected Systems
Android devices that contain the NFC dispatcher component with the insecure default setting are vulnerable; the CVE payload does not specify a particular Android version, so affected releases cannot be identified without consulting the referenced security bulletin.
Risk and Exploitability
The CVSS score of 10 indicates maximum severity. The EPSS score of less than 1% shows a very low, but not zero, current exploitation probability. The flaw is not yet listed in the CISA KEV catalog. Exploitation requires only local access to the device; no network or user interaction is needed, making it potentially easier for an insider or an attacker with physical or local device access to exploit. The absence of user prompts lowers the detection risk. Consequently, the risk remains high for any device that is not patched or hardened against NFC-based privilege escalation.
