A logic flaw in Android's DomainVerificationService occurs in the approvalLevelForDomainInternal routine, allowing an attacker to hijack an arbitrary app link. This manipulation escalates privileges locally without requiring execution of additional code or user interaction, potentially granting the attacker elevated privileges, as explicitly described in the vulnerability statement.

The vulnerability affects the Google Android operating system, specifically the DomainVerificationService component. No specific Android version range is listed in the available data, so all releases employing this service could be impacted until a patch is released.

The CVSS score is 7.8 and the EPSS score is < 1%, suggesting a moderate‑to‑severe vulnerability but with a low probability of exploitation in the wild. The flaw allows local privilege escalation directly through a logic bypass, meaning any device owner or user could be compromised with no further privileges or external trigger. The vulnerability is not listed in the CISA KEV catalog. Because the exploit requires only local access to the affected service, the risk remains significant for all users of vulnerable Android devices. The attack vector is inferred to be local, originating from a non‑trusted app or malicious link processed by the system.