This vulnerability in Google Android arises from a confused deputy problem in the onCreate method of PaymentDefaultDialog.java. It permits an attacker with local access to escalate privileges by changing the default payment application without needing extra execution privileges or user interaction. The affected versions explicitly include Android 15, 16, 16-qpr2, and 17. There is no CVSS score or vendor advisory indicating a fix or mitigation at this time.

An attacker with local access could exploit this vulnerability to elevate privileges on the affected Android devices by changing the default payment app. This could potentially allow unauthorized actions within the payment system context. No user interaction is required, increasing the risk of silent exploitation. However, there are no known exploits in the wild and no further details on impact severity from the vendor.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should monitor for updates from Google and apply them promptly once available.