The flaw lies in obfuscated interface elements that can present privileged actions as benign, enabling local privilege escalation without acquiring additional execution rights or needing user interaction.

Android devices distributed by Google. No specific version numbers are disclosed, so any Android installation at the time of the bulletin may be affected until the update is applied.

The CVSS score of 7.8 is reported, the EPSS is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation can be performed locally, without user interaction or remote network access, and without requiring extra execution privileges; after the privilege escalation occurs, the attacker gains higher-level device access.