A flaw in SystemUI’s RemoteQCController fails to validate package signatures when resolving a hardcoded content:// URI. This omission enables an unprivileged application to take over a specific authority if the legitimate package is missing, inject malicious UI elements into the trusted Quick Controls panel, and obtain a Background Activity Launch (BAL) grant when the user interacts with the spoofed element. The result is that the attacker can trigger background activities with elevated privilege without explicit user approval.

The vulnerability affects Google’s Android operating system, specifically the SystemUI component that manages quick controls. No particular version range is specified, indicating that current releases vulnerable until a fix is applied.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying limited publicly known exploitation. The attack vector is local, requiring the attacker to install an unprivileged app on the device. If successful, the attacker can launch background activities that may perform further malicious actions, potentially compromising confidentiality and integrity of user data. The severity depends on the system’s exposure to background activity execution and the attacker’s ability to deceive the user by mimicking legitimate UI controls.