The vulnerability arises from a logic error that allows a user or local process to bypass Android’s permission checks. This means that code which normally requires explicit permission can read sensitive data that it should not access. Because the flaw exists in multiple code paths, an attacker can exploit it without elevated privileges, and no user interaction or execution privileges are necessary to reveal the data.

Android systems provided by Google are affected. The description does not specify affected component versions or Android releases; therefore exact version coverage is unknown. The flaw originates from the Android codebase, likely within the framework layer that manages permission enforcement.

The exploit requires only local access to the device and does not rely on remote code execution or privileged escalation. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of active exploitation. Its impact is confined to confidential data disclosure; the overall risk remains moderate until a vendor patch is issued.