The flaw lies in the getAppLabel method of ForgetDeviceDialogFragment.java, where the interface can mislead a user into forgetting a device. This mislabeling can lead to local escalation of privilege because the device’s management functions can be accessed or altered without the need for additional execution permissions. The weakness is a type of improper restriction of a feature or function, as noted by the CWE-451 identifier.

Affected are Android devices that run the Google Android platform and include the ForgetDeviceDialogFragment component. No specific version information is provided, so all builds containing the vulnerable code path may be impacted. Refer to the Android security bulletin for patch details.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, but the CVE notes that user interaction is not needed for exploitation, suggesting an attacker with local access can trigger the flaw automatically, possibly through another application or system process. The vulnerability is not listed in the CISA KEV catalog, implying no widely known active exploitation yet, but the ability to achieve local privilege escalation makes it a serious risk for affected devices.