The vulnerability resides in the onActivityResult callbacks used throughout Android, where protected profile contacts may be inadvertently exposed due to a confused deputy flaw. The flaw allows a local actor to extract private contact information without requiring any user interaction. This leakage can subsequently be leveraged to elevate privileges on the device, granting the attacker additional capabilities such as accessing protected files or services that normally require higher authority.

The affected vendor is Google, specifically Android operating systems. No specific version is listed in the data, so all Android releases that include onActivityResult handling are potentially impacted.

The exploit requires only local access and does not need user interaction, reducing the attack barrier. Exploitation probability is unknown as the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw enables privilege escalation and reveals sensitive personal data, the risk to any compromised device is significant. The absence of a publicly available patch or workaround means that risks remain until an official fix is released.