The flaw arises from a logic error that allows files to be shared across distinct user profiles on the same Android device. Because the code incorrectly permits cross‑profile access, information that should be confined to a single profile can be read by another profile without needing any additional privileges. The vulnerability does not require code execution or any active user interaction, and based on the description, it is inferred that any user who gains access to a profile that may not have the appropriate data restrictions could exploit this vulnerability.

The affected product is the Google Android operating system. All devices running the affected Android code are potentially vulnerable, though specific version ranges are not listed in the advisory. The logic error appears in multiple locations throughout the OS, implying that any device that implements the buggy code could be impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that there are currently no known large‑scale exploits or limited public exploitation data. Based on the description, it is inferred that the attack vector is local and requires no execution privileges or network interaction. The likelihood of exploitation depends on the attacker’s proximity to a user profile on the device, but the ability to read confidential files across profiles represents a significant breach of confidentiality and could enable further attacks if combined with other vulnerabilities.