EUVD-2026-33792
GHSA-m48c-vf9h-rvr2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious low-privilege Android app
-
DeliverySubmit crafted binary resource table to system parser
-
ExploitTrigger OOB read in validateNode
-
ExecutionLeak sensitive memory from privileged process
-
PersistChain leak into privilege escalation
-
ImpactExecute code as system/root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local code execution on the device as an unprivileged Android app (PR:L) on Android 14, 15, 16, or 16-qpr2 running a pre-June-2026 security patch level, and must be able to feed a malformed binary resource structure to a process that invokes ResourceTypes.cpp::validateNode. No user interaction is required once the malicious app runs (UI:N). Limiting factors: the bug is local-only (AV:L) so cannot be triggered over the network, requires the attacker to first get an app installed on the device, and the OOB read primitive likely needs to be chained with another vulnerability to achieve meaningful code execution as a higher-privileged user. |
| Impact | The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) correctly characterizes this as a high-impact local vulnerability requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact at the OS level. EPSS is extremely low at 0.01% (1st percentile), and the issue is not listed in CISA KEV, indicating no observed mass exploitation. The CWE-125 out-of-bounds read primitive alone is typically used for info-leak rather than direct code execution, so the 'EoP' label suggests it is likely chained with another bug - defenders should treat this as a building-block vulnerability rather than a standalone weaponizable flaw. Note that the description states 'no additional execution privileges needed' which is consistent with PR:L (an installed app) rather than PR:N; the wording refers to no further escalation primitive being required beyond the bug itself. |
| Exploit ScenarioDerived | A user is convinced to sideload or install a low-privilege malicious app from an untrusted source. The app triggers resource parsing on a crafted binary resource table, causing ResourceTypes.cpp::validateNode to read out of bounds in a privileged Android service, leaking memory or corrupting state that the attacker chains into elevation to system_server or root context - all without further user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 02, 2026
Local privilege escalation in Android 14, 15, and 16 (including 16-qpr2) stems from an out-of-bounds read in the validateNode function of ResourceTypes.cpp, part of the Android resource parsing layer. A local attacker running an unprivileged app can leverage the flaw to elevate privileges without user interaction. No public exploit identified at time of analysis and EPSS is very low (0.01%), but the issue is addressed in the June 2026 Android Security Bulletin.
Earlier versions of this analysis (2)
Local privilege escalation in Google Android's ResourceTypes.cpp affects Android 14, 15, 16, and 16-qpr2 through an out-of-bounds read in the validateNode function. A local attacker holding low-level privileges can exploit a faulty bounds check to escalate to higher privileges without user interaction. No public exploit identified at time of analysis and EPSS rates exploitation probability at just 0.01%, but the issue is addressed in the June 2026 Android Security Bulletin.
Local privilege escalation in Google Android's resource parsing subsystem (ResourceTypes.cpp) allows an attacker with device access to gain elevated privileges through an out-of-bounds read triggered by an incorrect bounds check in the validateNode function. Affected versions span Android 14, 15, 16, and 16-qpr2, representing a broad installed base. No public exploit code exists and EPSS probability sits at 0.01% (1st percentile), indicating no public exploitation activity at time of analysis; the June 2026 Android Security Bulletin addresses this flaw.
RemediationAI
Apply the June 2026 Android Security Bulletin patches by updating to a security patch level of 2026-06-01 or later as documented at https://source.android.com/docs/security/bulletin/2026/2026-06-01; OEM rollout timing varies, so on managed fleets enforce a minimum patch level via MDM/Android Enterprise compliance policies. As a compensating control until the patch is installed, restrict installation of untrusted third-party APKs (disable 'Install unknown apps' for all sources) and use Play Protect plus enterprise app allow-listing, since exploitation requires local code execution via an installed app; note this does not protect against a malicious app that is already present. No vendor-released patched component version is enumerated beyond the security patch level identifier.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ResourceTypes.cpp is part of the Android resource handling subsystem (libandroidfw / AAPT) used to parse compiled binary resource tables (resources.arsc) inside APKs and framework assets. The validateNode routine performs structural validation on resource chunks, and an incorrect bounds check leads to a CWE-125 out-of-bounds read - the code reads memory past the end of an attacker-controlled buffer. Because this parser executes inside privileged Android system processes (e.g., system_server or installd) when handling resource data from less-trusted callers, an OOB read can leak sensitive memory or be combined with other primitives to enable privilege escalation, consistent with the CVSS High/High/High impact triad.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
7DescriptionCVE.org
In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A local privilege escalation vulnerability in Android 14, 15, and 16 (CVE-2026-0076) allows unprivileged applications to gain system privileges without user interaction, affecting hundreds of millions of deployed smartphones and tablets globally. No vendor patch is currently available, and while measured exploitation probability remains minimal, the vulnerability persists across widely-deployed operating system versions with no immediate remediation path. Organizations must prepare rapid deployment procedures for when vendor patches release and implement interim protective measures to reduce device exposure.
No vendor-released patch identified at time of analysis. Reduce attack surface by restricting application installation to official app stores, disable side-loading of untrusted applications through device management policies, implement monitoring for unusual privilege escalation events on vulnerable devices, and enforce managed-device policies requiring automatic patching upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB