The vulnerable function checkWhetherCallingAppHasAccess in Android’s DownloadProvider allows an application that is not granted proper privileges to access resources on another app’s behalf. As a confused deputy, the provider fails to validate that the calling app possesses the necessary permissions before revealing internal data. This flaw can lead to local information disclosure without requiring elevated privileges or user interaction.

Google’s Android operating system includes the affected DownloadProvider component. The advisory does not specify affected Android versions; any installation of Android that contains the unpatched DownloadProvider is potentially vulnerable.

The lack of an EPSS score limits quantitative assessment, and the CVE is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. Nevertheless, the local data leakage can expose user‑specific files or application internals. Exploitation requires the attacker to be able to invoke the provider from another application context; no remote or privilege‑escalation steps are needed, meaning anyone with a local app installation could leverage the flaw to read protected data that the provider loads.