Which versions of Google Android are affected by CVE-2026-0063?

Android 17 devices contain a critical local privilege escalation in the telephony subsystem allowing attackers to disable carrier restrictions without user interaction; no public exploit currently…

How to fix or mitigate CVE-2026-0063?

24 hours: Identify and inventory all Android 17 devices in deployment; document carrier restriction configurations and baseline access controls. 7 days: Implement or strengthen physical device access restrictions and deploy MDM solutions to monitor telephony subsystem configuration changes. 30 days: Monitor Google Android Security Bulletin for Android 17 patches; develop device upgrade timeline or establish long-term alternative mitigations.

Google Android CVE-2026-0063

Q: What is the CVSS score of CVE-2026-0063?

CVE-2026-0063 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37575 CRITICAL

Improper Privilege Management (CWE-269)

2026-06-17 google_android

Privilege Escalation Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local attack via an installed app (AV:L, PR:L, UI:N); logic error reliably triggered (AC:L); integrity of carrier-restriction state is broken (I:H) with no confidentiality or availability impact and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:29 vuln.today

CVE Published

Jun 17, 2026 - 07:24 cve.org

CRITICAL 10.0

DescriptionCVE.org

In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android's telephony subsystem (PhoneInterfaceManager) allows attackers to disable carrier restrictions without any user interaction or additional execution privileges. The flaw stems from a logic error in the setAllowedCarriers handler and is addressed in the Android Security Bulletin for Android 17. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

PhoneInterfaceManager.java is the AOSP framework service that exposes telephony APIs (including carrier restriction controls) to apps and system components via Binder IPC. The setAllowedCarriers method is intended to be gated so that only privileged callers (carrier-privileged apps or system UID) can modify which carriers a device is allowed to use - a control used to enforce SIM-lock/carrier-lock policies on subsidized or operator-locked devices. A logic error in this permission/validation path lets an unprivileged local caller bypass the intended gate and clear or alter the allowed-carrier list. Affected CPE is cpe:2.3:a:google:android (versions unspecified in the feed), with the fix shipped in the Android 17 security bulletin. No CWE is assigned, but the behavior is consistent with CWE-285 (Improper Authorization) / CWE-863 (Incorrect Authorization).

RemediationAI

Patch available per vendor advisory: apply the Android Security Bulletin for Android 17 (https://source.android.com/docs/security/bulletin/android-17) by updating to a security patch level that includes the fix to PhoneInterfaceManager.setAllowedCarriers. Pixel users should take the next monthly OTA; other OEM users should install the vendor's corresponding monthly patch once available, and MDM administrators should enforce minimum patch-level compliance on managed devices. As a compensating control until patches land, restrict sideloading via Play Protect / MDM app-install policies and audit installed apps for unexpected telephony permission use, recognizing the trade-off that this does not block a malicious app that is already installed from invoking the vulnerable Binder call.