A logic error in onStrongAuthRequiredChanged of UsbService.java allows an unauthenticated user to enable USB data transfer without authentication, resulting in a local privilege escalation. The flaw bypasses security checks, permitting an attacker to gain elevated access through the USB interface without user interaction or additional execution rights.

The flaw exists in Android operating systems from Google. No specific version information is available, so all Android releases are potentially vulnerable until a vendor patch is issued.

The CVSS score of 6.8 indicates a moderate severity risk. The EPSS score is not available. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw without user involvement by connecting a USB device, but physical USB access is required, limiting the attack surface. With no evidence of active exploitation, the potential for privilege escalation remains significant.