This vulnerability in Google Android arises from a logic error that enables tapjacking attacks in multiple locations within the codebase. Tapjacking here allows an attacker to trick the system into performing unintended actions, resulting in local privilege escalation without needing additional execution privileges or user interaction. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The affected versions are Android 15 and 16. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

Successful exploitation leads to local elevation of privilege on affected Android devices, potentially allowing attackers to gain higher privileges than intended. This can compromise system confidentiality, integrity, and availability. No user interaction is required, increasing the risk of silent exploitation. However, exploitation requires local access to the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users and administrators should monitor for updates from Google and apply patches promptly once released.