Technical impact
The vulnerability in AndroidManifest.xml is a missing permission check that enables an attacker to provoke a persistent denial of service. The flaw is classified as CWE‑862: Missing Permission. Without any additional privileges, a local adversary can trigger a crash or halt of the targeted component or service. The impact is confined to the affected app or service rather than the entire OS; based on the description, it is inferred that the denial requires local access to the vulnerable component.
Affected Systems
The flaw targets Google Android, including Wear OS, as referenced by the 2026/06/01 security bulletin. The CPE list indicates versions 14.0 and 16.0 of Google Android, as well as any Wear OS device. Specific version patches are not disclosed, so any device running the vulnerable software is potentially affected.
Risk and Exploitability
The CVSS base score of 10.0 marks the flaw as critical. The EPSS score of less than 1% indicates a low exploitable probability at present. The vulnerability is locally exploitable without privilege escalation or user interaction, so any device with the affected component is at risk. It is not yet listed in CISA KEV, so no known exploitation is documented, but the severity and local nature warrant prompt remediation.
