The register protection of the PowerVR GPU is incorrectly configured, enabling local attackers to read sensitive data without needing elevated privileges. The flaw results in a local information disclosure and does not require user interaction, simplifying exploitation. This weakness falls under CWE‑284, an access control failure that allows unauthorized data access.

Google Android devices, including Pixel handsets, are affected by this misconfiguration. The advisory does not list specific Android version numbers, so the vulnerability status is not tied to any particular build; only devices using the affected PowerVR GPU configuration are at risk.

The CVSS score of 4 indicates moderate severity, while the EPSS score of <1 % shows a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, implying either recent discovery or low exploitation activity. Attackers would require local presence on the device and could obtain protected data without additional privileges. Overall risk is moderate, but the low exploitation probability and lack of remote access reduce immediate urgency—administrators should still promptly apply updates.