The vulnerability resides in the getMessenger method of WifiP2pServiceImpl, where a missing permission check allows a local user to obtain elevated privileges without needing additional permissions or user interaction. The flaw enables an attacker to gain higher system rights and potentially modify system settings or access restricted data, categorised under CWE‑732 for missing authorization.

The affected vendor is Google and the product is Android. No specific Android release or version is listed, so the defect could affect any Android build that includes the WifiP2P service without the missing check. The lack of version information means the issue may exist across multiple releases until a patch is applied.

The CVSS score is not provided, but the impact of local privilege escalation is serious. Because the exploit requires no user interaction and can be performed by any user on the device who has access to the WifiP2P service, the risk for environments that allow untrusted code to run locally is high. The vulnerability is not currently listed in the CISA KEV catalogue and no EPSS score is available, suggesting that widespread exploitation has not been documented yet, but the lack of a mitigation in the current release means that local adversaries can still exploit the flaw.