A memory corruption flaw caused by type confusion exists in multiple locations of Android. The vulnerability can be exploited locally to acquire higher privileges without needing any additional execution privileges or user interaction. As the flaw allows privilege elevation, an attacker can execute code with elevated rights on the affected device.

The flaw affects Google’s Android operating system. No specific versions are listed, so all Android distributions built on the affected code may be vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the absence of user interaction and the ability to locally elevate privileges suggest a high likelihood of exploitation. The CVSS score of 7.8 indicates a high severity, so defenders should treat the issue as a serious local privilege escalation risk.