In the Android ConnectionServiceWrapper, the function queryRemoteConnectionServices is implemented with a permission check that is incorrect, creating a confused deputy scenario that can be exploited by a local user to gain higher privileges without needing additional execution rights or user interaction. This flaw permits a malicious local process to impersonate a system service, allowing it to perform privileged operations that it normally could not. The impact is a local privilege escalation that can compromise device integrity, enabling a user to tamper with system resources, install malware, or exfiltrate sensitive data.

All Android devices that include the vulnerable ConnectionServiceWrapper implementation are affected. The adverse effect applies to devices running any Android version where this code path exists, regardless of specific build or device model, as no version information is provided in the advisory.

The vulnerability allows local privilege escalation without user interaction, indicating that an attacker who already has local access can exploit the flaw immediately. While the EPSS score is not available and the vulnerability has not been listed in KEV, the nature of the flaw and its ability to bypass permissions represent a high severity risk. Exploitation does not require network connectivity or additional privileges, making it easier to deploy an attack vector on affected devices.