In the Android operating system, multiple components contain a permission bypass that arises from a confused deputy scenario. The bypass allows a local attacker to read data that the victim’s applications should protect, even though no additional execution privileges or user interaction are required. This flaw aligns with the CWE identifiers CWE-639 and CWE-269 and represents a clear information disclosure route.

The affected product is Google Android. The CVE definition does not specify affected releases or internal components, so any device or vendor ships that include the impacted code paths could be vulnerable. Administrators should suspect that all recent Android releases up to the current advisory may contain the flaw until a patch is released.

Because the vulnerability is local and does not demand elevated privilege or user interaction, an attacker who has physical or local access to a device can exploit it to leak private information. The EPSS score is not available and KEV does not list it, meaning there is no known exploitation record in CISA databases; however, the nature of the flaw and its lack of prerequisites make it a high‑potential risk for devices that handle sensitive data. Once the vendor publishes a security patch, deployment will mitigate the attack surface.