The vulnerability arises in the Android Settings application where a permission check is performed incorrectly, allowing a lower‑privileged component to act on behalf of a higher‑privileged one. This confused deputy flaw can be exploited by a local user to elevate privileges without executing any additional code. An attacker could subsequently obtain root or other privileged capabilities, enabling full control over the device.

Any Android device running the affected version of the Settings application. The flaw is documented by Google for the Android platform, but specific affected builds are not listed in the data. It applies to the Settings component across the device.

Because the flaw is local and requires no user interaction, any user with access to the device can launch the attack. The CVSS score is 7.8, and the EPSS score is < 1%. The vulnerability is not yet in the CISA KEV catalog, but the nature of privilege escalation indicates a severe risk. An attacker could leverage this to gain root or other high privileges, potentially compromising all data and functionalities.