Google Android EUVD-2026-33815

Exploitation requires local access to the device (AV:L) and a low-privileged application installed on an affected Android version - Android 14, 15, 16, or 16-QPR2 (PR:L per CVSS vector). No user interaction is required (UI:N). Because the flaw resides across multiple functions of AppOpsService.java with no specific feature toggle or non-default configuration cited as a prerequisite, any affected Android device with a locally running low-privileged application satisfies the conditions. What limits exploitation: the attack is strictly local-scope (AV:L, S:U) - remote network exploitation is not possible; the impact is confined to information disclosure only (C:L, I:N, A:N), meaning an attacker gains read access to protected data but cannot modify system state or cause a denial of service; and the attacker must already have code executing on the device as a low-privileged app, ruling out purely passive or drive-by attack paths.

CVSS 3.3 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N reflects a local-only attack surface requiring a low-privileged caller, with limited confidentiality impact and no integrity or availability consequences. SSVC corroborates low urgency: exploitation status is none, the attack is not automatable (no remote vector exists), and technical impact is only partial. No EPSS score was provided in the input data - this gap should be noted when prioritizing against other Android bulletin items. The absence of a CISA KEV listing and any identified POC code means this vulnerability is not being actively or opportunistically exploited at time of analysis. Real-world risk is limited to scenarios where a malicious or trojanized local application attempts to harvest protected App Ops information - relevant for threat models involving sideloaded apps or compromised devices, but not a critical priority compared to remote or unauthenticated vulnerabilities in the same bulletin cycle.

A locally installed application with low privileges on an affected Android 14-16 device calls vulnerable functions in AppOpsService without the expected permission enforcement being applied, allowing it to read protected system or user information - such as App Ops state or usage data for other applications - that should be inaccessible. No public proof-of-concept code has been identified at time of analysis, limiting immediate exploitation risk. The attack requires physical or logical access to the device with at least a user-installed application context, confining the threat primarily to trojanized apps or insider-access scenarios.