This vulnerability in Google Android affects versions 14 through 16-qpr2 and allows a local attacker to bypass permission controls by resetting user-selected permissions in multiple locations. Exploitation does not require user interaction or elevated privileges initially, which facilitates local privilege escalation. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The weakness is related to CWE-693, indicating improper control of permissions or access rights. As of the published date, no patch or official remediation level has been disclosed by the vendor.

Successful exploitation of this vulnerability could allow a local attacker to escalate privileges on the device, potentially gaining higher access rights than intended. This could compromise the confidentiality, integrity, and availability of the affected system. Since no user interaction is required, the attack surface is broader for local adversaries. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should monitor for updates from Google and apply them promptly once available. No specific temporary mitigations or workarounds have been provided.