What is the CVSS score of CVE-2026-0098?

CVE-2026-0098 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Android are affected by CVE-2026-0098?

CVE-2026-0098 is a HIGH severity privilege escalation in Google Android versions 14 through 16-qpr2, affecting potentially billions of mobile devices globally.

How to fix or mitigate CVE-2026-0098?

24 HOURS: Inventory all Android devices running versions 14, 15, 16, or 16-qpr2; alert mobile security and device management teams. 7 DAYS: Deploy MDM policies restricting app installation to trusted sources; implement application allowlisting on high-sensitivity devices; brief leadership on risk timeline and mitigation strategy. 30 DAYS: Monitor Google and OEM vendor advisories for patch release for affected Android versions; prepare staging environment to validate patch compatibility with organizational applications; develop phased rollout plan.

Google Android CVE-2026-0098

EUVD-2026-33808 HIGH

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-06-01 google_android

GHSA-mw23-v9j7-5fv7

Privilege Escalation

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:30 vuln.today

CVSS changed

Jun 01, 2026 - 23:22 NVD

7.8 (HIGH)

CVE Published

Jun 01, 2026 - 21:14 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 21:14 nvd

HIGH 7.8

DescriptionCVE.org

In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Articles & Coverage 1

medium.com CVE-2026-0098: Android App Version Spoofing Enables Silent Installation Jul 08, 2026

AnalysisAI

Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged app to bypass activity start restrictions through a confused deputy flaw in getCallingPackageName of Shared.java. No user interaction is required, and exploitation can yield high impact to confidentiality, integrity, and availability. No public exploit is identified at time of analysis, and SSVC indicates no observed exploitation in the wild.

Technical ContextAI

The flaw lies in the Android framework's Shared.java helper, specifically the getCallingPackageName routine used to identify the calling app when brokering activity launches. CWE-441 (Unintended Proxy or Intermediary, i.e. 'confused deputy') describes exactly this pattern: a privileged component performs an action on behalf of a caller while misattributing the caller's identity, allowing a low-privileged app to leverage the framework's authority to launch activities it would otherwise be blocked from launching. Affected CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, covering the AOSP/Google Android platform itself rather than a specific OEM build.

RemediationAI

Apply the Android Security Bulletin update dated 2026-06-01 from https://source.android.com/docs/security/bulletin/2026/2026-06-01 - ensure devices report a Security Patch Level of 2026-06-01 or later on Android 14, 15, 16, and 16-qpr2 branches; exact fixed build numbers should be taken from that bulletin since they were not enumerated in the input data. There is no documented configuration workaround for a framework-level confused-deputy bug, so compensating controls are limited: restrict installation of untrusted apps (disable 'Install unknown apps' for non-essential sources, enforce Play Protect, and require managed-app catalogs via MDM for enterprise fleets) to reduce the population of low-privileged callers that could trigger the flaw, accepting the usability trade-off of blocking sideloaded apps. For high-risk users, defer installation of newly published third-party apps until the device SPL is updated.