The flaw exists in setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService, where improper input validation can desynchronize the notification listener policy and allow a local attacker to grant themselves listener permissions they should not possess. This elevates the attacker’s privileges, enabling broader system access without any user interaction or additional execution rights.

Android operating systems distributed by Google are affected. All devices running Android that include the vulnerable NotificationManagerService module are at risk; the advisory does not specify a particular Android release, so any device at the time of discovery may be impacted.

The CVSS score of 8.4 is high, and the EPSS score is unavailable, but the vulnerability permits local privilege escalation without user involvement, giving an attacker the ability to gain system privileges. The flaw is not listed in the CISA KEV catalog, indicating no publicly known exploits yet; however, a malicious application could potentially trigger it by sending crafted input to the service.