arXiv:2610.20219v1 Announce Type: new Abstract: Integrated sensing and communication (ISAC) equips cellular networks with the dual capability of data transmission and environmental sensing by sharing spectrum, waveforms, and radio hardware. While network-side sensing via transmission-reception points (TRPs) has been widely investigated, the use of user equipment (UEs) as sensing receivers introduces additional bistatic viewpoints and can improve target observability. UE-assisted operation is nevertheless constrained by small UE apertures and by waveform processing, especially when data-bearing communication signals are reused for sensing. The present paper investigates theoretical limits and operating conditions for UE-assisted passive target positioning, with emphasis on hybrid operation that fuses TRP--TRP and TRP--UE measurements. A unified OFDM-based signal-and-noise model is developed to cover both positioning reference signals (PRS) and communication waveform reuse with modulation-dependent noise enhancement. Based on this model, closed-form Fisher-information expressions and Cramer-Rao lower bounds are derived for delay and angular parameters and are mapped to positioning error bounds (PEBs) for two estimator classes: time-angle positioning based on TDOA + DoA and delay-only 3D ellipsoid positioning based on excess-delay/TDOA measurements. Monte-Carlo simulations across reference SNR, subcarrier spacing and occupied bandwidth, modulation order, radar cross section (RCS), sensing mode, and positioning algorithm identify regimes where UE participation and hybrid sensing provide significant gains and quantify the associated estimator-to-bound trade-offs.