The vulnerability resides in InstallPackageHelper.java within the Android package installation process. A logic flaw allows a sideloaded application to bypass the Enhanced Confirmation Mode (ECM) and alter the package source during a self‑update. The flaw requires only user execution privileges and does not need user interaction, making it possible for a local attacker to gain elevated rights on the device.

Affected systems are Android devices running any version that includes the handlePackagePostInstall logic in the Android Framework. Specific affected releases are not listed by the CNA, so all current Android builds should be considered potentially vulnerable until a patch is confirmed.

Since EPSS data is unavailable and the issue is not yet catalogued by CISA KEV, the current exploitation probability is unclear. However, the CVE description says no user interaction is needed, implying that any user who installs a malicious app and then triggers a self‑update of that app could be escalated. The risk manifests locally; an attacker who can install an application and control its update process can gain privileges higher than the installing user. The vulnerability is therefore a significant local privilege escalation risk awaiting vendor remediation.