An integer overflow in the Android permission handling subsystem allows a permissive bypass, enabling a process running with normal user privileges to elevate itself to System execution privileges. The flaw arises when arithmetic operations fail, resulting in an incorrect authorization decision that grants undue access. This bypass can be leveraged to install or run privileged code on the device without needing any user interaction, potentially compromising device integrity and confidentiality.

The vulnerability applies to Google Android devices; no specific version was listed in the advisory. All builds affected by the identified integer overflow are potentially impacted, regardless of release channel or device model.

The exploit requires local code execution on an unpatched Android device. Because user interaction is not needed, any local process or user can trigger the integer overflow. The flaw has a CVSS score of 6.7, indicating medium severity, and its EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, since local privilege escalation can undermine device integrity and confidentiality, the risk to affected devices remains significant.