A logic error in Android’s CallIntentProcessor allows a local user to trigger an emergency call without performing the expected permission checks. The flaw resides in the fixInitiatingUserIfNecessary method and requires the attacker to have normal user execution privileges and user interaction to activate a call intent. While the vulnerability does not provide remote code execution or data exfiltration, it enables a legitimate emergency number such as 911 to be dialed automatically from a user‑level application, potentially leading to false emergency responses and unnecessary police or ambulance dispatches. The CVSS score of 4.0, which is categorized as medium severity, reflects the potential impact of this local escalation.

The vulnerability affects all Android releases that include the CallIntentProcessor module, namely Android 14.0 and 15.0 as well as Android 16.0 and its qpr2 beta builds (qpr2_beta_1, qpr2_beta_2, qpr2_beta_3). Every device running any of these releases and not yet patched by the vendor’s security bulletin is potentially exploitable.

The CVSS score is 4.0, indicating medium severity, and the EPSS score is below 1%, showing a very low probability of exploitation. The flaw is local and requires a user to initiate the call intent, therefore casual or automated attacks are unlikely. An attacker with physical or logical access can exploit the vulnerability by launching an application that requests an emergency call, but no remote attack vector is apparent. The vulnerability is not listed in CISA’s KEV catalog, which suggests no known active exploitation at present.