This vulnerability (CVE-2026-20470) involves an improper export of Android application components in MediaTek chipsets, specifically within the Telephony functionality. Due to a missing permission check, an attacker with local access could disclose sensitive information without needing elevated privileges or user interaction. The issue is tracked under CWE-926 (Improper Export of Android Application Components). The CVSS v3.1 base score is 6.2, indicating medium severity, with confidentiality impact but no integrity or availability impact. The vulnerability affects a broad range of MediaTek chipset models as explicitly listed. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with local access to a device using an affected MediaTek chipset could exploit this vulnerability to disclose sensitive information from the Telephony component without needing additional privileges or user interaction. The impact is limited to confidentiality, with no impact on integrity or availability. This could potentially aid further attacks or information gathering but does not directly allow code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users and administrators should monitor MediaTek's advisories for updates. Until a fix is available, limiting local access to trusted users and devices may reduce risk.