An integer overflow in the Android permission handling subsystem allows a permissive bypass, enabling a process running with normal user privileges to elevate itself to System execution privileges. The flaw arises when arithmetic operations fail to respect maximum integer boundaries during permission checks, resulting in an incorrect authorization decision that grants undue access. This bypass can be leveraged to install or run privileged code on the device without needing any user interaction, potentially compromising device integrity and confidentiality.

The vulnerability applies to Google Android devices; no specific version was listed in the advisory. All builds affected by the identified integer overflow are potentially impacted, regardless of release channel or device model.

The exploit requires local code execution on a device that has not yet received the relevant security patch. Because user interaction is not required, any user or local process can perform the overflow. While no publicly disclosed CVSS score is available, the nature of the flaw—automatic privilege escalation—indicates a high‑severity risk. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the local nature and lack of requirement for privileged remote interaction keep it a significant concern for all affected Android devices.