A missing permission check in several functions of Android's NfcService.java allows a local attacker to bypass intended access controls, elevating privileges without needing additional execution rights or user interaction. The flaw enables a zero‑interaction escalation path that can grant the attacker privileges beyond those assigned to the legitimate application.

Google Android devices are affected by this vulnerability. No specific Android version is listed, so all installations using the impacted NfcService code are potentially vulnerable. Users should check with Google or Android security advisories for applicable update information.

The EPSS score is <1%, indicating a low probability of exploitation, yet the CVSS score of 8.4 highlights a high severity. The flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation. However, the nature of the vulnerability—local privilege escalation without user interaction—poses a significant risk, as a local attacker can exploit the missing permission check through the NFC stack to elevate privileges beyond those granted to legitimate applications.