This vulnerability in Android's NFC implementation allows an attacker to spoof NFC events due to a missing permission check. This flaw enables local privilege escalation without requiring any prior execution privileges or user interaction. The vulnerability is identified as CWE-862 (Missing Authorization). It has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. The affected version explicitly stated is Android 17. No patch or remediation information is currently available.

Successful exploitation allows an attacker to escalate privileges locally on an affected Android device via NFC event spoofing. This can compromise device security without needing user interaction or prior execution privileges, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should monitor official Google Android security advisories for updates. No specific temporary mitigations are provided in the available data.