In the MicroXR Blobstore component of Google Android XR, a missing permission check permits one installed application to read or otherwise access files belonging to another application. This flaw allows a local attacker to gain elevated privileges within the device environment, escalating from their current user context to higher privileges without the need to execute additional code. The vulnerability is categorized as a local privilege escalation, presenting a direct threat to the confidentiality and integrity of data stored by other applications.

The affected product is Android XR, specifically its MicroXR Blobstore implementation. The CVE data does not list a specific version range, so any devices running Android XR with the unpatched blobstore may be impacted. No other vendors or products are currently noted as affected.

The CVSS score of 10.0 marks this flaw as critical, and the lack of user interaction indicates that exploitation can occur entirely from a local context. Although the EPSS score is < 1%, the absence of a CISA KEV listing suggests no confirmed exploits yet, but the condition is still severe. An attacker with local device access, which could be achieved via physical possession or by compromising an app with sufficient authority, could leverage the missing permission check to read or manipulate files of other applications, leading to potential data exfiltration or further compromise.