The LocaleManagerService’s getXmlFileNameForUser method contains a confusable path traversal that can bypass permission checks. This flaw permits a local attacker to read files outside the intended scope, leading to confidential data disclosure without the need for elevated privileges or user interaction. The weakness exemplifies a classic path‑traversal attack that undermines the isolation guarantees of Android’s file system.

All Google Android devices that include the vulnerable LocaleManagerService and have not yet received the official security patch. Since the vulnerability description does not specify a version range, it applies to every Android release that retains the original implementation. Consequently, current builds pending an update are affected.

The issue is not listed in the CISA KEV catalog and EPSS data is unavailable, but the combination of local-only exploitation, no privilege escalation, and zero user interaction suggests a moderate to high risk posture. An attacker with local code execution or the ability to install malicious applications could trigger the traversal automatically, potentially exposing sensitive files or configuration data across the device.