The vulnerability resides in AppOpsService.java where a permission check has been omitted. This omission permits local users to read sensitive information without acquiring additional privileges or performing any user interaction, thereby compromising confidentiality.

All Google Android devices that run affected Android operating system versions. The precise version range is not disclosed in the advisory.

Because the flaw is local and requires no elevated privileges, an attacker with physical or local access can exploit it. The CVSS base score of 3.3 indicates low severity. The EPSS score is not available and the vulnerability is not listed in the KEV catalog, indicating no known active exploitation yet. Nonetheless, the severity of a confidentiality breach warrants prompt attention, and the lack of user interaction lowers the barrier for misuse.