The flaw is a confusion in the getCallingPackageName method of Android's Shared.java. Attackers can run an application that bypasses the system’s activity‑start restrictions, allowing the app to launch privileged activities as though it had higher permissions. This bypass can be achieved without any additional execution privileges or user interaction, resulting in local privilege escalation. The weakness is identified as CWE‑441, Confused Deputy.

The issue affects Android devices that include the Shared.java framework component. The advisory does not specify particular Android releases, so all currently shipping Android versions that have this component could be vulnerable until the patch is applied. Google explicitly references the issue in their 2026‑06 security bulletin.

The attack vector is local and does not require remote code execution. An attacker can embed the exploit in a malicious app or exploit an existing app with the right permissions to trigger the bypass. Because the EPSS score is not available and the vulnerability is not in CISA’s KEV catalog, the immediate likelihood of exploitation is uncertain, yet the CVSS score of 7.8 signals a high severity local privilege escalation that could elevate a device’s attacker capabilities.