A logic flaw in the AccountManagerService.onResult callback may allow an attacker to manipulate the user interface, causing the system to grant additional privileges to a process without requiring user interaction or additional execution rights. This flaw enables local privilege escalation, allowing a malicious app or resident code to acquire higher privilege levels within the Android kernel or system services.

The vulnerability affects Android operating systems where the native AccountManagerService implements the cited logic. Specific affected versions are not disclosed; the flaw potentially impacts all Android builds that include the vulnerable implementation of AccountManagerService, regardless of marketed OS level.

The flaw presents a high‑risk local privilege escalation threat, as exploitation does not depend on remote code execution or user action. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, but the inherent risk of local privilege escalation remains significant. An attacker with local access can leverage this logic error to elevate privileges and perform unauthorized actions on the device.