A permissions bypass flaw in Android’s Telecomm component lets an application initiate a phone call without the system’s authorization, effectively granting the attacker local privilege escalation. The vulnerability is caused by improper access control that allows background or malicious software to trigger call‑making functionality without user consent, potentially enabling unauthorized calls and data interception.

The affected vendor is Google and the product is Android Telecomm. No specific version information has been supplied; any Android installation containing the vulnerable Telecomm package may be impacted.

The CVSS score of 10 indicates critical severity. An EPSS score of less than 1% suggests that exploitation in the wild may be infrequent, and the flaw is not listed in the CISA KEV catalog. Because user interaction is not required, the likely attack vector involves an attacker deploying a malicious application that invokes the Telecomm service to place calls without permission.