The Android launcher can be crashed by an unauthorized shortcut that causes resource exhaustion, resulting in a local denial of service without requiring additional privileges. The crash can be triggered without user interaction.

Google Android devices. No specific version information is provided in the advisory; the issue relates to the ShortcutInfo component in Android's launcher code.

Based on the description, it is inferred that the attack does not require user interaction or escalated privileges. Any local user or malicious application capable of creating shortcuts may exploit the weakness, as elevated privileges or user interaction are not required. The CVSS and EPSS metrics are not publicly listed, and the vulnerability is not included in the CISA KEV catalog, but it still enables service disruption on the affected device.