Unauthorized system operations via missing permission check

Permission bypass in vivo Permission manager module before Android 10 allows local users to invoke protected system operations via an installed app. The module accepts protected-operation requests from locally installed applications without enforcing its required permission check; vivo has not disclosed the affected interface or function. User interaction and low-privilege local access are required, and exploitation exposes protected data or interrupts service, with no reported ability to modify data.