The vulnerability arises from missing permission checks in several code paths, allowing a local attacker to gain unauthorized privileges without additional execution rights. This flaw enables an elevated local user to act with higher privileges than intended, potentially compromising sensitive device functions and data. The weakness is based on improper authorization controls, which can lead to full system compromise if exploited by local malicious apps or users.

Vendors: Google Product: Android Affected Versions: Specific version information is not disclosed in the provided data. The issue is noted in multiple locations within the Android codebase, indicating that the flaw exists across various releases of the platform.

The exploit does not require user interaction or additional exploitation steps, so an attacker on the device can immediately take advantage of the missing checks. The EPSS score of < 1% indicates a very low probability of exploitation, and the absence of a KEV listing suggests that no active public exploits are known at this time. The flaw remains a high‑severity risk for local attackers due to the fundamental lack of permission enforcement and the ability to elevate privileges without further action.