The flaw lies in CertInstaller.java’s getCallingAppLabel method, which can be manipulated to hide the user interface that prompts for certificate installation. This omission allows a local user or malicious app to add a certificate without the user’s notice, elevating its privileges on the device. The weakness is an improper user interface flow that can be exploited (CWE-451).

This vulnerability affects all Android devices that include the CertInstaller component of Google’s Android OS. The specific Android release series is not disclosed, meaning the flaw applies to any firmware version until a vendor‑issued update that patches CertInstaller is installed.

The CVSS base score of 7.8 indicates high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the attack does not require user interaction or elevated execution privileges, any local user could exploit it. The attack vector is local, requiring only that the attacker has a foothold on the device, making the risk significant when the device is exposed to untrusted apps or scripts.