What is the CVSS score of CVE-2026-0078?

CVE-2026-0078 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2026-0078?

A privilege escalation vulnerability in Google Android 14, 15, 16, and 16-qpr2 allows attackers with local device access to elevate privileges without user interaction, potentially enabling…

How to fix or mitigate CVE-2026-0078?

Within 24 hours: Identify and catalog all Android 14, 15, 16, and 16-qpr2 devices across your environment. Within 7 days: Complete vulnerability impact assessment; implement interim mitigations including device access controls and privilege escalation monitoring; notify device users of risk. Within 30 days: Monitor Google Android security advisories for patch release; establish and test patch deployment procedures for affected versions.

Android CVE-2026-0078

EUVD-2026-33794 HIGH

Improper Input Validation (CWE-20)

2026-06-01 google_android

GHSA-m46h-7gfx-97wc

Privilege Escalation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 02, 2026 - 16:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 02, 2026 - 16:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 02, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jun 02, 2026 - 16:22 NVD

MEDIUM HIGH

CVSS changed

Jun 02, 2026 - 16:22 NVD

5.9 (MEDIUM) 7.8 (HIGH)

Analysis Generated

Jun 02, 2026 - 14:30 vuln.today

CVSS changed

Jun 02, 2026 - 14:22 NVD

5.9 (MEDIUM)

CVE Published

Jun 01, 2026 - 21:14 nvd

MEDIUM 5.9

CVE Published

Jun 01, 2026 - 21:14 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) stems from improper input validation in the setGlobalProxy method of DevicePolicyManagerService.java, causing a desynchronization in persistence state. A local attacker with low-level privileges can exploit this without user interaction to elevate to higher privileges on the device, with no public exploit identified at time of analysis and an EPSS score of 0.01% indicating minimal observed exploitation activity.

Technical ContextAI

DevicePolicyManagerService is a core Android system service that manages device administrator policies, including network proxy settings applied across the device. The setGlobalProxy method allows authorized callers to configure a system-wide proxy, and its implementation persists policy state across reboots. The root cause is CWE-20 (Improper Input Validation): insufficient validation of inputs to setGlobalProxy creates a desynchronization between the in-memory policy state and the persisted state, which can be leveraged to bypass intended policy enforcement boundaries. CPE data confirms the affected product is Google Android (cpe:2.3:a:google:android), and the bug lives in framework code shared across major Android branches.

RemediationAI

Apply the June 2026 Android security patch level (2026-06-01 or later) as published in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-06-01; OEM-shipped builds should incorporate the corresponding AOSP framework fix to DevicePolicyManagerService. Exact AOSP tagged release versions are not enumerated in the available input data beyond the affected branches (Android 14, 15, 16, 16-qpr2), so confirm the patch level via Settings > About phone > Android security update on each device. Where immediate patching is not possible, compensating controls include restricting installation of untrusted apps via managed Google Play or MDM allowlisting (trade-off: reduces user flexibility), enforcing strict Device Admin / Device Owner provisioning policies so untrusted apps cannot reach DevicePolicyManager APIs (trade-off: increases enrollment friction), and monitoring for anomalous proxy-policy changes via EMM telemetry where supported (trade-off: detection-only, not preventive).