Android CVE-2026-0084

Exploitation requires that a malicious or compromised low-privilege application be installed and running on the target Android 16 or Android 16-QPR2 device; this is the initial foothold condition (PR:L per CVSS). The logic error is in HostEmulationManager.java, meaning the NFC Host Card Emulation subsystem must be present (standard on modern Android devices). No user interaction is required at exploitation time once the app is installed (UI:N). What limits exploitation: the attack is local (AV:L), requiring physical device access or a social-engineering vector to install the initial app; it does not apply to Android versions other than 16 and 16-QPR2; and SSVC Automatable: no indicates the exploit cannot be trivially scripted for mass targeting.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a meaningful local privilege escalation: an attacker needs only a low-privilege app installed on the device and no user interaction at exploit time, with full confidentiality, integrity, and availability impact. EPSS is very low at 0.12% (2nd percentile), consistent with SSVC Exploitation: none, indicating no observed in-the-wild abuse at time of analysis. The SSVC Technical Impact rating of 'total' aligns with the CVSS impact triad; however, Automatable: no limits scalable mass exploitation. Even a mid-sized municipal IT team in leszno managing a mixed Android 16 fleet should treat this as a priority patch given that insider threat or malware delivery scenarios require only a sideloaded or malicious Play Store app to achieve full device compromise. The primary limiting factor is physical or remote access to deploy the initial low-privilege app - once that precondition is met, exploitation requires no further interaction.

A threat actor distributes a malicious Android app - via phishing, a rogue MDM profile, or a trojanized sideload - that appears benign and requests only minimal permissions. Once installed and running in the background, the app triggers the logic error in HostEmulationManager.java to launch a privileged background activity, hijacking the UI and gaining full device control without prompting the user for additional permissions or confirmation. No public proof-of-concept code has been identified at time of analysis.