This vulnerability in Google Android (versions 15 and 16) arises from a logic error that enables tapjacking attacks in multiple code locations. Tapjacking here can lead to local elevation of privilege without needing user interaction or extra execution privileges. The CVSS 3.1 base score is 6.2, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No official fix or patch has been confirmed as of the published date.

An attacker with local access to an affected Android device could exploit this vulnerability to escalate privileges without user interaction or additional execution privileges. This could lead to unauthorized access to sensitive information (high confidentiality impact). There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users and administrators should monitor Google’s advisories for updates. No specific mitigation steps are provided by the vendor at this time.