In the DeviceAdminAppsPreferenceController.updateState method a logic error allows a permission bypass that can elevate a non‑privileged application to device administration level. This local privilege escalation occurs without the exploitation of any additional execution privileges. It is inferred that the vulnerability could be abused by a malicious application or by compromising an existing vulnerable application, and it does not require user interaction.

The flaw affects Android devices from Google that include the DeviceAdminAppsPreferenceController component. Version information is not specified in the advisory, so any Android build that contains the unpatched updateState logic may be vulnerable. Device owners should check whether their current OS release includes the fix for this code path.

The CVSS score of 7.8 classifies the flaw as high severity. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation can occur locally via a malicious application and does not require network access or user interaction. A local attacker can gain full device administration rights, potentially compromising confidentiality, integrity, and availability of the device data and functions.