The flaw resides in the sendAnomalyProfile function of ProfilingService.java, where a path traversal vulnerability can be exercised. An attacker able to control the target path can read or write files outside intended directories, enabling the elevation of local privileges. The vulnerability requires no additional execution rights and does not need user interaction, so it can be exploited by any local process with sufficient permissions to invoke the affected service.

Android devices that run Google Android with the affected ProfilingService implementation. No specific Android releases or device models are listed, so all installations of the service remain potentially vulnerable until a patch is applied.

The vulnerability can be exploited locally and does not require network access or elevated privileges at the start. The EPSS score is < 1% and the CVSS score is 8.4, and the issue is not listed in the CISA KEV catalog, suggesting that while the risk is high in terms of potential impact, the likelihood of exploitation in the wild is currently unknown. The likely attack vector is local exploitation through the profiling service API, possibly by a malicious application that can trigger the path traversal.