In the VPU component of Android, a missing permission check can be exploited to bypass authorization controls. This flaw enables a local user, who does not require any user interaction, to elevate privileges to System execution level. The vulnerability is a classic privilege‑escalation weakness, lacking proper authorization to access critical resources, and constitutes a security risk that could allow malicious apps or users to control privileged system functions.

Google Android devices, including Pixel hardware, are affected. The flaw exists in the VPU component of the operating system; specific version details are not provided in the advisory.

Although no CVSS score is listed, the missing permission check allows local privilege escalation without user interaction, indicating a potentially high impact. EPSS is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Attackers would need local access to the device and the ability to run code within an unprivileged app. Once the bypass is achieved, they can gain System execution privileges, which could lead to full device compromise.