A logic error in the Android framework’s ApplicationActionButtonsPreferenceController allows an attacker to bypass a permission check that disables the uninstall button. The flaw does not require additional execution privileges and can be exploited without user interaction, enabling a local attacker to gain elevated privileges within the system.

Android devices running the Google framework are impacted. No specific Android version or build variants are listed in the advisory, so all devices using the affected component are potentially vulnerable until patched by Google.

The flaw carries a CVSS score of 7.8, which classifies it as high severity. The EPSS score is below 1%, suggesting a low probability of widespread exploitation in the wild, yet the lack of user interaction and local execution requirements mean that any user with physical or local access to a device could abuse the permission bypass. The vulnerability is not yet listed in the CISA KEV catalog, but the logic error allows a local attacker to elevate privileges without additional privileges or execution rights, making it a significant risk for all affected Android devices that have not yet applied the vendor patch.