EUVD-2026-33803
GHSA-x52h-cw59-46x3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconTrick user into installing low-privilege app
-
DeliveryInvoke vulnerable framework component
-
ExploitRender obfuscated/misleading UI element
-
InstallSystem misinterprets UI state and grants privileges
-
C2Execute code with elevated privileges
-
ExecutePersist via privileged component
-
ImpactAccess protected data and system functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Attacker must already have local code execution on the device as a low-privileged app (CVSS AV:L, PR:L) - i.e., a malicious or compromised installed application running in the standard Android app sandbox. No user interaction is required (UI:N), and no additional execution privileges beyond the initial low-privileged foothold are needed per the description. Exploitation is limited to Android 14, 15, 16, and 16-qpr2 devices that have not yet received the June 2026 (2026-06-01) security patch level; devices on earlier or already-patched branches, and remote attackers without an installed app, are out of scope. |
| Impact | Signals are mixed. CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H rates it 'High' and indicates a low-complexity attack from a low-privileged local app yielding full CIA impact - consistent with a meaningful sandbox-escape style privilege escalation. CISA's SSVC framework, however, reports Exploitation: none and Automatable: no, with only Technical Impact: total agreeing with the CVSS severity, suggesting the bug is impactful in principle but not currently being exploited and not trivially scriptable at scale. No KEV listing and no EPSS score is provided, and no PoC is referenced. The note that 'User interaction is not needed for exploitation' in the description, combined with UI:N in CVSS, is internally consistent but slightly atypical for a CWE-451 finding - verify with the vendor advisory whether the misleading UI deceives the OS rather than the user. Net: a real Android-tier privilege-escalation issue worth prioritizing in the June 2026 monthly patch cycle, but not an emergency outside of high-risk mobile fleets. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app that holds only low-privilege (PR:L) permissions. The app silently invokes the vulnerable framework path, presenting an obfuscated UI element that the system misinterprets as a privileged consent or trusted-caller indication, and the app is granted elevated privileges without the user ever seeing or tapping a prompt. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) stems from a misleading UI caused by UI obfuscation across multiple components, enabling a low-privileged local app to elevate privileges without user interaction. No public exploit identified at time of analysis, and SSVC indicates exploitation status is 'none' despite a total technical impact rating.
RemediationAI
Patch available per vendor advisory - apply the June 2026 Android Security Bulletin update by ensuring devices reach the 2026-06-01 (or later) security patch level as published at https://source.android.com/docs/security/bulletin/2026/2026-06-01; exact framework versions per affected branch (14, 15, 16, 16-qpr2) are enumerated in that bulletin. Where OEM patches lag, compensating controls include restricting sideloading via Play Protect and MDM policies, disallowing installation from unknown sources, requiring Work Profile separation for untrusted apps, and using MDM to enforce minimum patch level on managed devices (trade-off: blocks otherwise functional devices from accessing corporate resources). Disabling apps' ability to draw overlays (Settings → Apps → Special access → Display over other apps) reduces the attack surface for UI-spoofing classes of bug at the cost of breaking legitimate floating-window features such as chat heads and accessibility tools.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause maps to CWE-451 (User Interface (UI) Misrepresentation of Critical Information), a class of weakness where the UI presents information in a deceptive way - through overlays, obfuscation, spoofed prompts, or hidden context - causing a user (or the operating system acting on the user's behalf) to authorize an action they did not intend. The CPE string cpe:2.3:a:google:android:*:*:*:*:*:*:*:* identifies the Android platform itself rather than a specific app, and Google's bulletin describes the issue as residing 'in multiple locations,' implying several Android framework or system UI components share this UI-obfuscation pattern. Because the CVSS vector specifies UI:N (no user interaction), the misrepresentation likely allows a local app to spoof system-level prompts or consent dialogs in a way that the system, rather than the user, is tricked into granting elevated privileges.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android versions 14-16 contain a privilege escalation vulnerability enabling low-privileged applications to gain unauthorized system-level access without user awareness. This affects a broad installed base and poses direct risk to organizational data stored on employee mobile devices. The absence of a vendor patch necessitates immediate inventory and interim defensive controls to prevent device compromise through malicious or compromised applications.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce managed app store-only installations via MDM; disable sideloading; deploy mobile threat defense solutions with exploit detection capabilities; restrict app permissions to minimum required access; enable and verify Google Play Protect on all affected devices; monitor device logs for unauthorized privilege escalation; implement app reputation filtering; stage upgrade path to unaffected Android versions (17+) for post-patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB