What is the CVSS score of CVE-2026-0019?

CVE-2026-0019 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Android are affected by CVE-2026-0019?

A high-severity local privilege escalation in Android 17's SettingsLib component allows low-privileged applications to disable critical system components without user interaction, creating direct…

How to fix or mitigate CVE-2026-0019?

Within 24 hours, conduct an inventory of Android 17 devices in production and prioritize those with unrestricted application permissions; assess current application-installation policies and curated app store usage. Over the next 7 days, implement enhanced app permission controls and restrict third-party application installation to curated enterprise app stores, and communicate the vulnerability to users with guidance to avoid untrusted app sources. Within 30 days, establish a patch readiness plan with Google for Android 17 SettingsLib updates, deploy device management solutions with enhanced application sandboxing and monitoring capabilities, and establish daily monitoring of vendor security advisories and CISA KEV database for patch availability notifications.

Android CVE-2026-0019

EUVD-2026-37554 HIGH

Improper Privilege Management (CWE-269)

2026-06-17 google_android

Privilege Escalation Google

7.8

CVSS 3.1 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Local pre-installed low-priv app (AV:L/PR:L/AC:L, UI:N); component-disabling EoP yields high integrity/availability impact but only limited confidentiality (C:L), so not full C:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:31 vuln.today

CVE Published

Jun 17, 2026 - 05:53 cve.org

HIGH 7.8

CVE Published

Jun 17, 2026 - 05:53 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android 17's SettingsLib component allows a low-privileged local app to disable system components through a logic error, potentially elevating to higher privileges with no user interaction. The flaw is a CWE-269 improper privilege management issue reported through the Android Security Bulletin process, with no public exploit identified at time of analysis and a low EPSS of 0.13%. SSVC scores technical impact as total but exploitation as none, indicating a serious-if-reached but not currently exploited weakness.

Technical ContextAI

SettingsLib is a shared Android framework library used by the Settings app and other privileged system UI surfaces to read and modify device configuration, toggle features, and manage the enabled/disabled state of system components and packages. The root cause is CWE-269 (Improper Privilege Management): a logic error in this code path fails to correctly enforce the privilege boundary before allowing a component to be disabled, so an operation that should require elevated authority can be triggered from a lower-privileged context. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* scopes this to the Android platform itself, and EUVD data narrows the affected release to Android 17. Because SettingsLib runs within trusted system processes, mishandling of its component-state controls translates directly into a local escalation-of-privilege primitive.

RemediationAI

Patch available per vendor advisory: apply the Android security update that addresses CVE-2026-0019 by updating to the security patch level published in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/android-17, and cross-reference https://vuldb.com/vuln/371851. For fleet devices, push the OEM over-the-air update carrying that patch level and confirm the Settings > Security patch level reflects it. Because exploitation requires a locally installed low-privileged app, the most effective compensating control until patching is to restrict app installation to vetted sources (enforce Play Protect / managed Google Play, disable sideloading and unknown-sources installs via MDM), which trades some user flexibility for a smaller local attack surface; additionally, use MDM app-vetting/allowlisting to keep untrusted apps off privileged devices. No standalone non-update workaround for the SettingsLib logic error itself has been published, so the vendor patch is the definitive fix.