A logic error in multiple functions of MediaCarouselController.kt allows media content to be displayed after the feature has been disabled, resulting in the unintended exposure of local information. This vulnerability does not require the attacker to acquire additional execution privileges, and it can be exploited without user interaction. The impact is limited to local information disclosure rather than full system compromise.

Android devices provided by Google are affected, specifically those running software that includes the MediaCarouselController component. Version details are not listed in the advisory, so all current Android releases employing this code are potentially vulnerable until a fix is released.

The EPSS score for this issue is not available, but the advisory notes that an exploit does not require user interaction and needs no elevated privileges, indicating a straightforward local attack path. The risk is elevated by the fact that local data could be accessed by any app or user with access to the device, leading to potential privacy violations. Since this vulnerability is not yet listed in the CISA KEV catalog, there is no confirmed exploit in the wild yet, yet the vulnerability should be addressed promptly due to its potential to compromise sensitive media content.