This vulnerability in Google Android (versions 14 to 16) is due to a design flaw in InputInterceptor within Letterbox.java, which can be exploited through tapjacking or overlay attacks to trick the system into granting permissions improperly. The exploit enables local privilege escalation without requiring user interaction or prior execution privileges. The CVSS 3.1 base score is 6.2, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is classified under CWE-269 (Improper Privilege Management). No patch or official remediation level has been disclosed by Google as of the published date.

Successful exploitation could allow an attacker to escalate privileges locally on affected Android devices (versions 14, 15, and 16) without needing prior execution privileges or user interaction. This could compromise confidentiality by granting higher-level access than intended. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by Google, users and administrators should monitor for updates from Google regarding patches or mitigations. Until a fix is available, limiting local access to trusted users and avoiding installation of untrusted applications may reduce risk.