A missing permission check in TelephonyPermissions.java allows a local process to access cell identity information without needing any additional privileges. This flaw can reveal cellular network details and potentially other sensitive data to attackers who already have local access. The vulnerability does not require user interaction and does not enable code execution, but it compromises confidentiality of telephony metadata.

Theffected vendor is Google, specifically devices running the Android operating system. No specific version or build information is provided in the advisory, so any Android device prior to the fixed release could be impacted.

The Exploit Prediction Scoring System score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the flaw operates in a local context and does not require remote code execution, the overall risk is moderate; an attacker who can run code on the device can easily exploit the missing check to read restricted information. The likely attack vector is inferred to be a local attacker who can install or run code on the Android device, or a malicious app installed with broad permissions, as the vulnerability does not require user interaction. The absence of an elevated execution requirement means no additional privileges are needed beyond local access.