The flaw in the KeyChainActivity’s getApplicationLabel method can mislead users into approving certificates through an insufficient or deceptive interface. Because the certificate installation process can be executed without requiring the user to actively approve it, the attacker can gain elevated privileges on the device simply by having the certificate added. This escalation does not depend on additional execution privileges or external code execution; it leverages the trust model built into the Android certificate framework.

Google Android devices that include the vulnerable KeyChainActivity component. The specific Android OS versions affected are not detailed in the available data, but the issue applies to any Android release that contains the vulnerable code path.

The CVSS score of 7.8 is available, and the EPSS score is unavailable, so the quantitative likelihood of exploitation cannot be determined. The vulnerability is local, requiring the attacker to have some form of access to the device. It is not currently listed in CISA’s KEV catalog. The attack could be executed without active user interaction, making it potentially easier to exploit in environments where users are convenience‑oriented or in kiosk scenarios. The impact is a local privilege escalation that could enable further malicious actions such as installing additional certificates or privileged applications.