EUVD-2026-37554Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall low-privileged malicious app
-
DeliveryInvoke vulnerable SettingsLib path
-
ExploitTrigger component-disable logic error
-
ExecutionEscalate local privileges
-
ImpactGain elevated system control
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local code execution on the device as a low-privileged app (CVSS PR:L, AV:L) - for example a sideloaded or malicious installed application - which then abuses the SettingsLib component-disabling logic path; no user interaction and no additional execution privileges are needed (UI:N). Limiting factors: the attacker must first get an app installed and running on the target (no remote or network exploitation is possible), and the flaw is confined to Android 17 per EUVD data, so devices on other/patched releases are not exposed. There is no evidence of active exploitation (SSVC Exploitation: none) and the attack is not automatable at scale (SSVC Automatable: no). |
| Impact | The signals are consistent and point to a genuine-but-not-urgent issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8) describes an easy-to-exploit local attack from an already-installed low-privileged app with total impact, and SSVC agrees on total technical impact - but SSVC also records Exploitation: none and Automatable: no, meaning no observed exploitation and no wormable/scriptable mass-exploitation path. EPSS reinforces this with a very low 0.13% probability (3rd percentile), and there is no CISA KEV listing and no public exploit code. The main caveat is that the description frames the primitive as the ability to 'disable system components,' which is intrinsically an integrity/availability effect, while the assigned vector claims full confidentiality impact (C:H) - the confidentiality rating is somewhat generous for a component-disabling bug and should be verified against the vendor's fuller technical write-up. Net: prioritize for the normal Android monthly patch cycle rather than as an emergency, since local pre-conditions and lack of any exploitation evidence bound real-world risk. |
| Exploit ScenarioDerived | A user installs a seemingly benign app that holds only ordinary, low-privilege permissions. Leveraging the SettingsLib logic error, the app silently disables a targeted system component to escalate its own privileges locally, with no user interaction or additional permission prompt. No public proof-of-concept is currently available, and the local attack vector with low complexity means a working exploit would be reliable once developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Local privilege escalation in Google Android 17's SettingsLib component allows a low-privileged local app to disable system components through a logic error, potentially elevating to higher privileges with no user interaction. The flaw is a CWE-269 improper privilege management issue reported through the Android Security Bulletin process, with no public exploit identified at time of analysis and a low EPSS of 0.13%. SSVC scores technical impact as total but exploitation as none, indicating a serious-if-reached but not currently exploited weakness.
RemediationAI
Patch available per vendor advisory: apply the Android security update that addresses CVE-2026-0019 by updating to the security patch level published in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/android-17, and cross-reference https://vuldb.com/vuln/371851. For fleet devices, push the OEM over-the-air update carrying that patch level and confirm the Settings > Security patch level reflects it. Because exploitation requires a locally installed low-privileged app, the most effective compensating control until patching is to restrict app installation to vetted sources (enforce Play Protect / managed Google Play, disable sideloading and unknown-sources installs via MDM), which trades some user flexibility for a smaller local attack surface; additionally, use MDM app-vetting/allowlisting to keep untrusted apps off privileged devices. No standalone non-update workaround for the SettingsLib logic error itself has been published, so the vendor patch is the definitive fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SettingsLib is a shared Android framework library used by the Settings app and other privileged system UI surfaces to read and modify device configuration, toggle features, and manage the enabled/disabled state of system components and packages. The root cause is CWE-269 (Improper Privilege Management): a logic error in this code path fails to correctly enforce the privilege boundary before allowing a component to be disabled, so an operation that should require elevated authority can be triggered from a lower-privileged context. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* scopes this to the Android platform itself, and EUVD data narrows the affected release to Android 17. Because SettingsLib runs within trusted system processes, mishandling of its component-state controls translates directly into a local escalation-of-privilege primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local pre-installed low-priv app (AV:L/PR:L/AC:L, UI:N); component-disabling EoP yields high integrity/availability impact but only limited confidentiality (C:L), so not full C:H.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
2DescriptionCVE.org
In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A high-severity local privilege escalation in Android 17's SettingsLib component allows low-privileged applications to disable critical system components without user interaction, creating direct risk to device security across the Android 17 fleet. No public exploit identified at time of analysis, though the vulnerability's technical impact warrants immediate inventory and mitigation efforts to minimize exploitation risk.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting application installation to curated enterprise app stores; enforcing granular application permission policies to limit access to sensitive system functions; implementing device management solutions with enhanced app sandboxing and behavior monitoring; disabling side-loading and restricting application installation sources; establishing monitoring for unusual app behavior or unauthorized system component modifications; maintaining daily tracking of vendor security bulletins and CISA alerts for patch release notifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB