The vulnerability arises in multiple locations within the Android implementation of dialInternal, where a permission check can be bypassed due to a confused deputy flaw. An attacker who can execute code locally on the device can exploit this flaw without needing any elevated execution privileges or user interaction. The result is an escalation of privileges, allowing the attacker to perform actions that normally require higher system permissions.

Google Android devices running any OS version that incorporates the affected dialInternal code paths. No specific version information is provided, so all current Android releases are potentially vulnerable until a patch is applied.

Based on the description, the likely attack vector is local device access that can invoke the vulnerable dialInternal method, allowing an attacker to bypass permission checks without elevated execution privileges or user interaction. The CVSS score of 7.8 indicates high severity, but the lack of a publicly available EPSS score makes the exact likelihood of exploitation uncertain. The local nature and no-user-intervention requirement suggest a high risk, and the flaw is not listed in the CISA KEV catalog, which may indicate that it has not yet been broadly exploited, though the potential for privilege escalation remains significant.