The vulnerability is a logic error in the ActivityStarter.executeRequest method that allows a background activity to be launched without proper authorization checks, leading to local privilege escalation. The flaw resides in the privilege‑safety logic of Android’s core component, enabling a malicious or compromised app to trigger the background activity and gain elevated control over internal system processes. No user interaction or external privileges are required for exploitation; the attacker can simply deploy or compromise an app running on the device.

Devices running affected versions of Google Android, as identified in the 2026‑09‑01 security bulletin, are vulnerable until the corrective update to ActivityStarter is installed.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation in the wild. The CVSS score of 7.8 signals high severity. Because the flaw is local and does not a locally compromised app can exploit it, making it a high‑priority issue.