Office for Android Spoofing Vulnerability

According to the CVSS metric, the attack vector is local (AV:L) and user interaction is required (UI:R), what does that mean for this vulnerability?
The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to click on a local file path link or download and run a malicious application or file.

What is the nature of the spoofing?
An attacker could manipulate a malicious link, application, or file to disguise it as a legitimate link or file to trick the victim.

Security updates
16.0.16026.20172 — https://support.google.com/googleplay/answer/113412?hl=en