The flaw resides in the onCreate method of PaymentDefaultDialog.java, default payment application through a confused deputy scenario. No additional execution privileges are required and no user interaction is needed, giving the attacker the same privilege level as the payment service and enabling unauthorized manipulation of payment functions.

Android devices that contain the PaymentDefaultDialog component are affected. The advisory does not specify a particular release, so any current Android build that includes this code path should be considered at risk until Google releases a patch.

The CVSS score of 7.8 indicates high severity; however, the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying low exploitation probability. Exploitation requires local access and no user interaction, limiting the threat to the device but granting the attacker privileges sufficient to alter payment settings.