Heap memory corruption in Netpbm's winicontopam converter affects releases before 10.86.51, 11.02.30, and 11.15.08, where a crafted ICO/CUR file declaring a width or height above 32767 wraps the signed int16_t row/column loop counters negative and drives writes through negative row buffer indices. The assessed vector is local (AV:L) with passive user interaction (UI:P) and no privileges required, so exploitation only occurs when a user, or a server-side or batch pipeline, runs winicontopam on attacker-supplied icon input; the confirmed outcome is a crash, with arbitrary code execution described only as a potential, non-demonstrated consequence. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in all three maintained branches.
Heap-based buffer overflow in Netpbm's sgitopnm converter affects releases before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07. A local, unauthenticated attacker can trigger it only when a user or automated job runs sgitopnm on a crafted RLE-compressed SGI image with an oversized offset table length, causing a heap write past the buffer that can crash the process and may permit code execution. No public exploit was identified at time of analysis, and the risk is context-dependent rather than an internet-facing emergency.
SQL injection in the access_token() authentication gate of the Control Web Panel (CWP) loopback API lets an attacker who can reach that endpoint inject through the authorization_code and client_id parameters into a query executed as the MySQL root user, exposing arbitrary database contents and allowing the authentication result to be forged so the API's auth check is bypassed. All CWP builds before 1.16 are affected; the vendor vector scores it 8.4 (CVSS 4.0, AV:L/PR:L) and our assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting that the endpoint is bound to localhost so a local foothold or an SSRF-style pivot into the loopback interface is a prerequisite rather than direct remote reach. EPSS is low at 0.23% (14th percentile), no public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.16 - on balance a serious but not emergency-grade issue that should be scheduled for patching this week.
A use-after-free race condition in multiple functions of base.c in the Android kernel lets an attacker who already runs code locally as an unprivileged app escalate privileges to kernel level, with no user interaction required. Local access is mandatory and the flaw is timing-dependent, so reliably winning the race is a practical limiting factor; exploitation is assessed as not automatable. No public exploit or confirmed active exploitation was identified at time of analysis, and the vendor has published upstream kernel fixes alongside the Android Security Bulletin.
Local privilege escalation in the Android kernel lets code that is already running on the device - a malicious installed app or a local shell - trigger a use-after-free in ksys_unshare() and corrupt kernel memory, potentially gaining elevated privileges. The flaw is reachable through the unshare() system call, which is callable without special privileges (CVSS PR:N) and needs no user interaction (UI:N), but it is strictly local (AV:L): the attacker must first obtain unprivileged code execution on the target by some other route, and the precise object-lifetime condition that fires the bug is not described in the available sources. No public exploit has been identified at time of analysis (SSVC exploitation: none) and no CISA KEV listing applies; the assigned priority is this_week, and the impact is rated total by SSVC (C:H/I:H/A:H, base 8.4).
Google Android 16, 16-qpr2, and 17 contain a use-after-free in multiple unspecified locations that can be triggered by code running locally on the device, such as a malicious or compromised app, without user interaction or additional execution privileges. Successful exploitation could elevate privileges and provide high confidentiality, integrity, and availability impact. No CISA KEV entry or public exploit reference is present in the supplied intelligence, so no public exploit is identified at time of analysis; remediation is tied to the November 2026 Android Security Bulletin (2026-11-01).
Local privilege escalation in Google Android 16, 16-qpr2, and 17 is caused by a use-after-free race condition in multiple platform code paths. An attacker who can already execute code on the device at low privilege can attempt to win the race and gain elevated privileges without user interaction; the assessed vector is local with high attack complexity, and reliable success is non-deterministic. No public exploit code or confirmed active exploitation is identified in the supplied data, and the November 2026 Android security bulletin is the vendor reference.
Android XR 14 contains a local privilege-escalation flaw in WindowManagerService, where the addDragDropListener path performs no permission check (CWE-862), so a locally installed, unprivileged app can register a drag-and-drop listener it should never be allowed to hold. Per the assessed vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, 8.4) the attacker must already have code running on the headset, but needs no privileges and no user interaction once that app is executing, and can then gain high-impact read and write capability over other applications' window/drag data. Exploitation is not confirmed (CISA SSVC exploitation: none, automatable: no), and no public exploit has been identified at time of analysis; the practical exposure is bounded by the narrow deployment base of the Android XR 14 headset platform.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 allows an app already running on the device to bypass a permission check by inducing an uncaught exception, yielding high confidentiality, integrity and availability impact within the local security boundary. The CVSS vector (AV:L/AC:L/PR:N/UI:N) means no pre-existing privileges and no user interaction are needed once attacker-controlled code executes locally; the flaw is not remotely reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.12% (2nd percentile), so signals point to moderate, patch-cycle urgency rather than an emergency - fixed builds are published in the Android Security Bulletin dated 2026-11-01.
A permission bypass in Android's NfcService.java allows any installed application, without special privileges or user interaction, to invoke NFC service functions that are missing their permission check and thereby escalate privileges locally to a higher-integrity context (CVSS 8.4, CWE-862). Affected branches are Android 14, 15, 16, 16-qpr2 and 17, with fixes published in the November 2026 Android Security Bulletin. Exploitation requires the attacker to already run code on the device; a public PoC reference exists but is not verified as working exploit code, EPSS is 0.12% (2nd percentile), and there is no CISA KEV listing, so signals point to a genuine but non-emergency local privilege-escalation issue.
Android 15, Android 16 and Android 16-qpr2 devices can have Factory Reset Protection bypassed through a missing authorization check in OemLockService.java, where setOemUnlockAllowedByUser fails to verify the caller holds the required permission (CWE-862). The flaw lets a local attacker set the OEM-unlock-allowed flag and clear FRP without user interaction, yielding high confidentiality, integrity and availability impact at a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U). Exploitation requires local access to the device - a locally installed or malicious app, or physical possession - and no public exploit code was identified at time of analysis; EPSS is 0.12% (2nd percentile) and the issue is not in CISA KEV.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 allows any installed application to obtain a handle to the Wi-Fi peer-to-peer service without holding the permission that access normally requires. Because the missing check sits in getMessenger of WifiP2pServiceImpl, the attacker needs no special Wi-Fi or system permission (PR:N), no user interaction (UI:N), and no non-default device configuration - only the ability to run an app on the device (AV:L). The 2026-11-01 Android Security Bulletin supplies the fix, EPSS is 0.12% (2nd percentile), and no public exploit was identified at time of analysis, so this is a moderate-urgency platform issue rather than an emergency.
Local privilege escalation in Google Android 14, 15, 16, 16-QPR2 and 17: a heap buffer overflow (CWE-122) in getEntryFileName in ZipFileRO.cpp, the native ZIP central-directory entry-name read path, can be driven by an attacker who already has local code execution on the device - typically an installed unprivileged app - to corrupt heap memory and gain code execution in the context of the privileged component that parses the archive, with no additional execution privileges and no user interaction required (CVSS 8.4, AV:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and its exploitation prerequisite is prior local execution; the exact malformed ZIP input that triggers the overflow is not detailed in the available sources. EPSS is low at 0.12% (2nd percentile) and no public exploit has been identified at time of analysis, but the vendor has published a fix in the 2026-11-01 Android Security Bulletin, and the priority assessment places remediation in the current week.
Local privilege escalation in Google Android 17 arises from a path traversal in ProfilingService.sendAnomalyProfile, allowing an attacker who can execute code locally to gain elevated privileges without additional execution privileges or user interaction. The issue is confined to the local attack vector and the affected Android 17 release; no public exploit was identified at time of analysis, and EPSS is low at 0.11%.
Local privilege escalation in Google Android 16, Android 16-qpr2, and Android 17 allows an attacker who can already execute code on the device to turn an integer overflow into an out-of-bounds write and gain elevated privileges without additional privileges or user interaction. No public exploit was identified at time of analysis; EPSS is 0.11% (1st percentile) and CISA KEV does not list it. Apply the November 2026 Android Security Bulletin update.
A missing permission check in the insertInternal method of Android's MmsProvider.java lets a locally installed application cross multiuser isolation boundaries and read or modify SMS/MMS data belonging to another user or profile, yielding local escalation of privilege with high confidentiality and integrity impact. Android 14, 15, 16, 16-qpr2 and 17 are listed as affected, and the flaw is rated 8.4 by the vendor-scale CVSS vector AV:L/AC:L/PR:N/UI:N, but exploitation is strictly local: the attacker must already have code running on the device and a multi-user or secondary-profile configuration must exist for the boundary to be meaningfully crossed. No public exploit code or CISA KEV entry was identified in the supplied data, and EPSS is low at 0.11% (1st percentile), consistent with a second-tier, this-week priority rather than an emergency.
Local escalation of privilege on Android 14, 15, 16, 16-QPR2 and 17 stems from misleading or insufficient consent UI in the platform's AllowBindAppWidgetActivity, where a user's reject action can be misunderstood as consent when binding an app widget. Exploitation requires a malicious app already installed and running on the device plus a victim who is fooled by the deceptive dialog, so the flaw is neither remotely reachable nor silently triggerable; the assessed vector is AV:L/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact. Risk telemetry is modest - EPSS 0.11% (1st percentile), no CISA KEV entry, and no public exploit identified at time of analysis - consistent with a this_week, moderate-priority decision rather than an emergency.
Local privilege escalation to code execution in Android 16, 16-qpr2 and 17 stems from a missing permission check (CWE-862) in nfa_t4tnfcee_store_rx_buf, part of the NFCEE Type-4-Tag receive-buffer handling in nfa_nfcee_act.cc. An attacker who already has a foothold on the device - an installed unprivileged or malicious app able to reach that NFC code path - can exploit it without any additional execution privileges, and no user interaction is required, yielding high confidentiality, integrity and availability impact as an NFC/Android-system-level component. Exploitation is local (CVSS AV:L, PR:N/UI:N); there is no confirmed active exploitation and no verified public exploit code, and EPSS is very low (0.11%, 1st percentile), so this is a this_week-priority hardening item for devices not yet on the 2026-11-01 Android security patch level.
Local privilege escalation in Google Android 16, Android 16-qpr2 and Android 17 allows an application already running on the device to bypass an activity-navigation permission check and obtain elevated read, write and execute-equivalent access to protected data and components. The flaw is a logic error in navigateUpTo within ActivityClientController.java, classified as a protection-mechanism failure (CWE-693), and is rated CVSS 8.4 with a local attack vector, low complexity, no required privileges and no user interaction. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as none and the attack as not automatable, although technical impact is rated total; the vendor reference is the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in the Android kernel allows unprivileged code running on the device to trigger a use-after-free in do_fault_around during fault-around page-fault handling, potentially corrupting kernel memory and leading to elevated code execution or denial of service. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, so no additional privileges or user interaction are needed once local code execution is achieved, and there is no remote exploitation path. No public exploit code or confirmed active exploitation was identified at time of analysis; SSVC rates exploitation as none and the decision label is this_week, making this a genuine but not emergency-grade priority.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 lets code already running on the device bypass a permission check in WindowState.java's prepareWindowToDisplayDuringRelayout and obtain high-integrity code execution, with no additional Android permissions (PR:N) and no user interaction (UI:N) required. The defect is a CWE-693 protection-mechanism failure in the window relayout path, scored CVSS 8.4 with total technical impact per SSVC. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and SSVC records the flaw as not automatable.
Local privilege escalation in the Android common kernel's FUSE backing passthrough code (fuse_backing_mmap in backing.c) lets an unprivileged app already executing on the device corrupt kernel memory through a use-after-free and obtain elevated privileges, with high confidentiality, integrity and availability impact. The attack is local only (AV:L) with no privileges or user interaction required once code runs (PR:N/UI:N), so a separate initial-access step such as installing or compromising an app is a prerequisite. Exploitation status is not confirmed: SSVC records Exploitation as none, no KEV entry is present, and no public exploit code has been identified at time of analysis; severity is rated 8.4 and vuln.today assigns a 'this_week' priority, with fixes shipped in the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in the Android common kernel's DMA-BUF subsystem allows an app that is already running on the device to convert a race-condition use-after-free in dma-buf.c into kernel-level code execution with system privileges. The assessed vector (AV:L/AC:H/PR:N/UI:N) means the attacker needs an existing local foothold but no additional privileges and no user interaction, and the timing dependency of the race is what makes reliable exploitation difficult; the published CVSS base score is 8.4, though the assessed complexity is High rather than the Low implied by the CVE record's own vector. No public exploit code and no active exploitation have been identified at time of analysis, and SSVC automation is rated 'no', so this is a serious but not currently weaponized local escalation issue.
A local privilege escalation exists in the Android kernel's process-creation code (fork.c), where a logic error across multiple functions leaves a freed object reachable and produces a use-after-free (CWE-416). Per the CVSS vector (AV:L/PR:N/UI:N), any party able to run unprivileged code on an affected device can trigger it without additional execution privileges or user interaction, and successful exploitation yields high confidentiality, integrity and availability impact at kernel level. Exploitation requires local code execution on the device and is not remotely reachable; SSVC records exploitation as none and no public exploit has been identified at time of analysis, so despite the 8.4 base score the practical urgency is measured rather than emergency-grade, with fixes delivered through the November 2026 Android Security Bulletin.
A logic error in multiple functions of SaveUi.java on Android 14, 15, 16, 16-qpr2 and 17 lets a locally installed application bypass package-installation requirements, yielding local escalation of privilege with high confidentiality, integrity and availability impact (CVSS 8.4, AV:L/PR:N/UI:N). The principal constraint is the local attack vector: the attacker must already have code running on the device, typically through an installed app, and the exact feature-level trigger inside SaveUi.java is not described in the available sources. No public exploit code and no active exploitation are indicated (SSVC Exploitation: none, Automatable: no), so this is a patch-this-week item rather than an emergency; the vendor bulletin is dated 2026-11-01.
Local privilege escalation in Google Android 15, 16, 16-qpr2, and 17 lets an attacker who can already execute code on the device trigger a use-after-free memory corruption and gain elevated privileges without additional execution privileges or user interaction. The flaw is not remotely reachable; the local-access prerequisite is the main barrier. No public exploit identified at time of analysis, no confirmed active exploitation, and SSVC records exploitation as none.
Local privilege escalation in the Android kernel allows code running in an unprivileged app context to escalate to kernel-level compromise, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.4, AV:L/AC:L/PR:N/UI:N). The root cause is a use-after-free (CWE-416) arising from a logic error present in multiple kernel locations; the description states no additional execution privileges and no user interaction are required, so a zero-permission application suffices as the entry point. No public exploit has been identified at time of analysis and SSVC records exploitation as none, but the fix is tracked through the November 2026 Android Security Bulletin, so exposure persists on any device that has not taken that patch level.
Local privilege escalation in Android's UriGrantsManagerService (Android 14, 15, 16 and 16-qpr2) lets code already running on the device bypass URI permission checks through improper input validation in writeGrantedUriPermissions. Per the CVSS vector (AV:L/AC:L/PR:N/UI:N) a local attacker needs no additional app permissions and no user interaction, yielding high confidentiality, integrity and availability impact. No public exploit is identified at time of analysis and CISA SSVC records no observed exploitation, though an Android Security Bulletin reference is provided for the fix.
A logic error in Android's background activity launch handling (tracked as CVE-2026-58837, CWE-693 protection mechanism failure) allows a locally installed app to escalate privileges and gain high confidentiality, integrity and availability impact on the device. Affected branches are Android 14, 15, 16, 16-QPR2 and 17, with a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the trigger is local only - a hostile or compromised app must already be running on the handset, but once it is, no elevated privileges and no user interaction are required. There is no public exploit identified at time of analysis (CISA SSVC Exploitation: none), and the flaw is addressed through the Android Security Bulletin dated 2026-11-01; the vendor does not name the specific components ('multiple locations'), so no configuration-specific precondition can be confirmed.
A logic error in AccountManagerService.onResult on Android 14, 15, 16, 16-qpr2 and 17 lets a locally installed app produce an untrusted or misleading result or UI, escalating privileges without any additional execution privileges and without user interaction. Google rates the impact as full loss of confidentiality, integrity and availability (CVSS 3.1 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the attacker must already be running code on the device because the vector is strictly local with no remote reachability. No public exploit code has been identified at time of analysis, and CISA SSVC marks exploitation as none and the flaw as not automatable, so the practical constraint remains the requirement for prior on-device code execution; the trigger sequence beyond the onResult logic error is not described in the available sources.
Local privilege escalation in Google Android 15, 16, 16-qpr2, and 17 arises from a confused-deputy permission bypass in NFC AID conflict resolution within RegisteredAidCache.resolveAidConflictLocked. A locally installed, unprivileged app can manipulate AID registration or routing so a more-privileged NFC or system component acts on its behalf, with no additional execution privileges and no user interaction required; the CVSS 3.1 score is 8.4. No public exploit was identified at time of analysis, SSVC exploitation is none, and the issue is serious but not urgent because the attacker must first get code running locally; builds at the November 2026 security patch level are fixed.
Local privilege escalation in Google Android 16 QPR2 and Android 17 lets an unprivileged app already running on the device bypass permission checks through a confused-deputy flaw and gain elevated access, with no user interaction required. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C/I/A High) produces a score of 8.4, but the attack surface is confined to local code execution on the affected builds. No public exploit was identified at the time of analysis, CISA SSVC records exploitation as none with total technical impact, and the Android security bulletin dated 2026-11-01 is the vendor reference for fixes.
Local privilege escalation in Google Android's MusicFX helper (MusicFxHelper.java, handleAudioEffectBroadcast) lets a locally installed, unprivileged application bypass a permission check through a confused-deputy condition, causing a more privileged Android component to act on the attacker's behalf and yielding high confidentiality, integrity and availability impact. Affected branches listed by the EUVD are Android 14, 15, 16, 16-qpr2 and 17; remote attackers cannot reach the flaw because the attacker must already be running code on the device, and no user interaction or additional execution privileges are required. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but not emergency-level priority scheduled for this week's remediation cycle.
Local privilege escalation in Android 17 allows an app already installed on the device to bypass permission checks and gain elevated access by invoking a privileged system component that fails to validate the caller's identity. The CVSS 8.4 score reflects high confidentiality, integrity and availability impact with no user interaction required, but the attack surface is strictly local - an attacker must first get code running on the device, and no network path exists. Exploitation is not confirmed: no public exploit code or KEV listing was identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', while technical impact is rated total; no EPSS score was supplied in the source data.
Local privilege escalation in Android's Wi-Fi system service (WifiServiceImpl.startTetheredHotspotRequest) allows an already-installed application to bypass permission checks through a confused-deputy pattern, gaining access to privileged tethering/hotspot operations without holding any granted permissions. Affected branches are Android 14, 15, 16, 16-qpr2 and 17, with a CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting local-only attack, no required permissions and no user interaction. Exploitation is not confirmed in the wild - SSVC records Exploitation: none and no public exploit code was identified at time of analysis - and the fix ships in the November 2026 Android Security Bulletin. The attack surface is bounded: an attacker must already have code execution on the device (a malicious or trojanized app), and SSVC marks the issue as not automatable.
Local privilege escalation in Android's telecom framework (queryRemoteConnectionServices in ConnectionServiceWrapper.java) allows a malicious or compromised app installed on the device to induce the privileged telecom service to act on its behalf, bypassing a permission check through a confused-deputy pattern (CWE-441). The flaw is rated CVSS 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no granted privileges and no user interaction are required, but it is not remotely reachable - the attacker must already have local code execution, in practice the ability to install and run an app. Android 14, 15, 16 and 16-qpr2 are listed as affected; no public exploit has been identified at time of analysis and fixes are addressed in the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in Android's GrantCredentialsPermissionActivity allows an installed application to obtain account credentials it should not be granted, by presenting a misleading or insufficiently informative permission dialog to the user. Affected platforms are Android 14, 15, 16, 16-qpr2 and 17 according to EUVD version data, with the vendor bulletin covering the Android Open Source Project component. The vector is local (AV:L) with no privileges required and high confidentiality, integrity and availability impact, rated 8.4; no public exploit has been identified at time of analysis and SSVC marks the flaw as not automatable, so the practical barrier is first obtaining app-level code execution on the device.
Local privilege escalation in Google Android's NotificationManagerService (affecting Android 14, 15, 16, 16-qpr2 and 17) lets an app running on the device drive a policy desynchronization in notification-listener access grants, yielding high confidentiality, integrity and availability impact. Per the CVSS vector (AV:L, PR:N, UI:N) the attacking app needs no previously granted privileges and no user interaction; it only needs a foothold on an affected build, so remote exploitation is not possible. No public exploit has been identified at time of analysis (SSVC exploitation: none) and the issue is scheduled in the vendor's November 2026 Android Security Bulletin, placing it in the current weekly patching cadence rather than an emergency response.
Local privilege escalation in the Android framework's UsbDialogHelper component, caused by misleading or insufficient UI (CWE-451) in the USB dialog path, affecting Android 14, 15, 16, 16-qpr2 and 17. Per the assessed vector (AV:L/AC:L/PR:N/UI:N), code already running on the handset can trigger the flaw without elevated privileges and without user interaction, yielding high confidentiality, integrity and availability impact; network reachability does not apply. Exploitation status is none per SSVC and no public exploit has been identified at time of analysis, so this is a real but non-urgent priority for the current week rather than an emergency.
Android's Storage Access Framework contains an access-control logic error in ExternalStorageProvider.java, specifically in the shouldBlockDirectoryFromTree method, allowing a locally-present app to reach protected data by abusing the document-tree interface. Because the vector is AV:L with PR:N and UI:N, any permission-less app already installed on the device can trigger the flaw without user interaction, yielding high confidentiality and integrity impact (our assessment scores it 8.4 with availability unaffected). The vendor lists the fix in the November 2026 Android security bulletin; no public exploit code or confirmed active exploitation is identified in the available data, and the this_week decision label reflects a serious but locally-gated issue rather than an urgent remote threat.
Android 14, 15, 16, 16-qpr2 and 17 contain a confused deputy flaw (CWE-441) in the AppTimeTracker deliverResult path that lets a locally installed app trigger a background activity launch and escalate to the privileges of a more trusted component, yielding high confidentiality and integrity impact. Per the independent assessment the malicious app needs no extra execution privileges and no user interaction (PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must first get code onto the device with no remote path available. No public exploit code or active exploitation is confirmed at time of analysis - SSVC Exploitation is 'none' and Automatable is 'no' - and the vendor bulletin is the November 2026 Android security release.
Local privilege escalation in Android's ActivityStarter component (resolveToHeavyWeightSwitcherIfNeeded in ActivityStarter.java) lets an app already installed on the device abuse a confused-deputy condition to make a privileged system component perform a background activity launch on its behalf, yielding high confidentiality, integrity and availability impact with no user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) confirms the attacker needs local code execution - in practice a locally installed application - but no additional execution privileges and no user tap; remote exploitation is not possible without first getting code onto the device. Affected versions reported are Android 14, 15, 16, 16-QPR2 and 17; SSVC rates technical impact as total but marks the flaw as not automatable with no exploitation observed, and there is no public exploit identified at time of analysis.
Background activity launch in Google Android 14, 15, 16, 16-qpr2, and 17 allows a locally installed app to start activities in the background by exploiting a confused deputy in ActivityTaskManagerService.moveTaskToFrontLocked, bypassing the task-ordering checks that are supposed to prevent exactly that. Per the assessed CVSS vector (AV:L/PR:N/UI:N), the attacker needs no special permissions and no user interaction once an untrusted app is running on the device, yielding high confidentiality and integrity impact with local escalation of privilege. The flaw is rated this-week priority rather than emergency: it is not marked as actively exploited in CISA KEV, SSVC records exploitation as none and automatable as no, and no public exploit code was identified at time of analysis. Fixes are delivered through the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 lets an unprivileged application already installed and running on the device abuse a confused-deputy flaw in AddAccountSettings.java, causing a privileged component to launch a background activity on the attacker's behalf and yielding high confidentiality and integrity impact with no additional execution privileges and no user interaction. The attack surface is strictly local (AV:L, PR:N, UI:N), so there is no remote vector, and the attacker must first get code running on the target. No public exploit identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and the issue carries a this-week priority, meaning it should be scheduled into the current patch cycle rather than treated as an emergency.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2, and 17 allows an app already installed on the device to exploit a missing permission check in AccessibilityWindowManager.setAccessibilityWindowAttributes and create untrusted or misleading UI. The independent assessment rates the issue AV:L/AC:L/PR:L/UI:N with high confidentiality and integrity impact, requiring a local app foothold but no user interaction, while SSVC records Exploitation: none and Technical Impact: total. No public exploit has been identified at time of analysis, and the vendor reference is the Android Security Bulletin for 2026-11-01.
Local privilege escalation in Google Android 17 allows an app already running on the device to abuse a confused-deputy component and execute sensitive USSD codes without additional execution privileges or user interaction, with high confidentiality and integrity impact. The issue is rated CVSS 8.4, no active exploitation is confirmed in the supplied data, and no public exploit identified at time of analysis; the vendor reference is the November 2026 Android Security Bulletin. This is a genuine prioritization candidate but not an emergency, matching the this_week decision label.
Intent redirection in Android 17's ContactsPickerActivity lets a locally installed malicious app relay an attacker-controlled intent into a more privileged handler, gaining the privileges of that handler and thereby escalating from an ordinary app sandbox to a higher-integrity context (CVSS 8.4, AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H). The confused-deputy flaw sits in forwardToPreferredActionPickHandler within ContactsPickerActivity.kt and requires no user interaction and no permissions granted to the calling component, but the attacker must already be able to run code or deliver an intent on the device - typically through a separately installed application. Affected scope is stated as Android 17 only; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but non-emergency local privilege-escalation issue slated for remediation in the current patch cycle.
A confused-deputy flaw in multiple Android onActivityResult handlers allows a locally installed app to read contact data belonging to a protected profile (such as a work or managed profile) without holding any permission for it. Per the assessed vector (AV:L/AC:L/PR:N/UI:N) the attacker needs only an installed app - no granted privileges and no user interaction - but the device must actually be configured with a separate protected profile holding the contacts, since without that boundary there is nothing to cross. Affected builds span Android 14, 15, 16, 16-qpr2 and 17 per EUVD; no public exploit code was identified at time of analysis and there is no CISA KEV entry, so priority follows the vendor bulletin rather than observed exploitation.
Stored cross-site scripting in FOSSBilling 0.1.0 through 0.8.8 lets an authenticated staff member holding only the support.manage_tickets permission plant HTML or JavaScript in a support ticket note via admin/support/note_create; the note is persisted unsanitized and later written into the DOM with innerHTML by the admin ticket list template. The payload executes in the browser session of any staff member who opens that ticket's notes, including a Super Administrator, allowing CSRF-token theft, exfiltration of accessible client and invoice data, and any administrative action the viewer's account permits. The vendor-released patch is 0.8.9; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor notes there is no complete workaround without patching.
Authorization bypass in NLnet Labs Krill lets an authenticated Krill operator assert an arbitrary child identity during parent-child provisioning when the target CA's parent CA is hosted on the same Krill server, bypassing the signed CMS verification normally used in the RFC 6492 exchange. The issue is conditional on a shared or multi-tenant deployment with co-located parent and child CAs; single-tenant setups with remote parents are not reachable through this path. CVSS 3.1 rates it 8.4 with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.