A missing permission check in addDragDropListener of WindowManagerService.java allows an application to invoke that function without the required authority. The flaw can elevate a local user process to higher privileges, providing an attacker the ability to execute actions normally restricted to privileged processes. No additional execution privileges are needed and no user interaction is required, meaning the vulnerability can be abused by any local software with sufficient context.

Google’s Android XR platform is affected. No specific version information is disclosed in the CVE data.

The CVSS score is 8.4, indicating a high severity. The vulnerability permits local privilege escalation and could be exploited by malware or malicious applications running on the device. Exploitation does not require user interaction or special privileges beyond those normally available to a local process. EPSS is unavailable and KEV is not listed, but the potential for unauthorized system-wide changes via privilege gain is significant.