A logic error in Android Keymint allows a local application to bypass authorization checks, resulting in the disclosure of sensitive information without the need for elevated privileges. This flaw can be exploited by any app that gains local execution, enabling attackers to read data that should be protected by system permissions.

Google Android devices are affected. No specific version numbers are provided, so all releases that include the vulnerable Keymint implementation may be impacted.

The flaw carries a CVSS score of 3.3 and an exploitation probability below 1 %. It is not listed in the CISA KEV catalog. Because the attack requires only local code execution and no user interaction, a malicious app running on the device can exploit it. The vulnerability is unlikely to be widely targeted at present, but it remains a potential risk for devices running unpatched Android versions.