The flaw resides in the setOemUnlockAllowedByUser method of OemLockService.java, where a missing permission check enables an attacker to bypass factory reset protection. This permits a local user to elevate privileges to a level sufficient to unlock the device without any additional privileges or user interaction. As a result, sensitive data and system integrity could be compromised, and the device could be reset or reconfigured without authorization.

This vulnerability affects Android devices running the Google Android platform. The specific affected versions are not enumerated, but the issue is documented in the 2026‑11‑01 Android security bulletin.

The CVSS score is not provided, and EPSS data is unavailable, but the exploit requires only local access and no user interaction. The damage potential is high due to the ability to bypass the factory reset protection barrier, and the vulnerability is listed in the 2026‑11‑01 security bulletin rather than in CISA’s KEV catalog. The lack of an immediate user interaction requirement means the attack could be carried out by any local user with physical access.