A component of Motorola’s system application was exported without permission, permitting an untrusted application to revoke runtime permissions from other installed apps on the device. This flaw allows an attacker to remove critical permissions from legitimate apps, potentially disrupting their functionality or gaining further privilege escalation by altering permission states. The weakness is classified as CWE-862, indicating that the system failed to enforce proper access controls.

The vulnerability affects Motorola devices running the Setup App component of the system, specifically versions that include the exported component prior to the 2026‑01‑01 Software Product Line release. Devices with older versions of the Setup App component are impacted and should be identified and upgraded accordingly.

The CVSS score of 4.8 indicates a moderate risk level. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local or inter‑process communication where a malicious app can call the improperly exported component. Since the flaw requires the presence of another application on the device, exploitation is plausible but not guaranteed without additional local access. The risk remains moderate until an official update is applied.