The flaw exists in the onPersistentGroupsChanged method of WifiP2pServiceImpl.java where a missing permission check allows an app to query or receive data it should not be able to access. This permission bypass means the attacker can obtain local information about Wi‑Fi peer‑to‑peer groups without needing any elevated privileges or user interaction. Because the vulnerability is purely local, an attacker must already be running code on the device, but the lack of authorization checks eliminates the usual safeguards.

Vendors and products affected are devices running the Android operating system distributed by Google. The specific versions impacted are not listed in the data provided, but the activity occurs in the core Android Wifi P2P framework code. Users should therefore consider any Android device that is still running an unreleased or unpatched version of the WifiP2p service beginning with the November 2026 security bulletin as potentially vulnerable.

The vulnerability is classified as a local information disclosure, with no requirement for higher execution privileges or user interaction. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified. The impact is limited to information that the executing app can read, but it does not enable arbitrary code execution or system compromise. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly known exploits, yet the missing permission check still poses a meaningful risk for malicious local applications.