The vulnerability arises from a logic error in the UsbDeviceManager.java handleMessage method, allowing an attacker to bypass the lock screen and gain access to sensitive device information. No additional execution privileges are required and the exploit can be performed without user interaction. The main consequence is the disclosure of physical device data that should be protected behind the lock screen.

The flaw exists in Google Android devices that include the UsbDeviceManager component. Specific vendor and product names are Android operating system; exact affected Android versions are not listed in the available data.

The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, the logic flaw grants direct access to device information, a high‑severity outcome. Because no user interaction is required, the attack can be triggered by simply sending a crafted USB message to the device. The attack vector appears to be local device access via USB, and it is therefore likely to be exploitable by anyone with physical or USB access to the device. Given the absence of a patch or workaround, the risk remains high until an official update is released.