The vulnerability exists in the addInputMethodListener method of the com.android.server.inputmethod.InputMethodManagerService component in Android XR 14. Due to a missing permission check, an attacker with local access can escalate privileges without requiring user interaction or additional execution privileges. This improper authorization issue is tracked as CWE-285 and is rated critical with a CVSS 4.0 score of 10, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Google as of the publication date.

Successful exploitation results in local privilege escalation on affected Android XR 14 devices, potentially allowing an attacker to gain elevated privileges without user interaction or additional execution rights. This could compromise system security and control, impacting confidentiality, integrity, and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided, users and administrators should monitor Google's security advisories for updates. Until a patch is available, restricting local access to trusted users and minimizing exposure to untrusted applications may reduce risk.