SystemUI unwraps PendingIntent through getIntent() allowing launching OngoingCallController arbitrary Activities via

In onEntryUpdated of OngoingCallController.kt, it is possible to launch non-exported activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.