What is the CVSS score of CVE-2026-0099?

CVE-2026-0099 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2026-0099?

A high-severity privilege escalation vulnerability in Google Android (versions 14-16) enables malicious applications to bypass security boundaries and launch arbitrary activities with elevated…

How to fix or mitigate CVE-2026-0099?

Within 24 hours: Catalog all Android 14, 15, 16, and 16-qpr2 devices across enterprise and BYOD infrastructure. Within 7 days: Deploy mobile device management (MDM) policies to enforce app allowlisting, disable sideloading, and restrict permissions for existing applications. Within 30 days: Monitor Android Security Bulletin and Google Play System Update channels; apply patches immediately upon vendor release (expected via quarterly Google Play System Updates).

Android CVE-2026-0099

EUVD-2026-33809 HIGH

Improper Check for Dropped Privileges (CWE-273)

2026-06-01 google_android

GHSA-g5w2-p7g6-9x7g

Privilege Escalation Google

7.8

CVSS 3.1 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (google_android) · only source for this CVE.

CVSS VectorVendor: google_android

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:30 vuln.today

CVSS changed

Jun 01, 2026 - 23:22 NVD

7.8 (HIGH)

CVE Published

Jun 01, 2026 - 21:14 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 21:14 nvd

HIGH 7.8

DescriptionCVE.org

In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged local app to launch an arbitrary activity from the background by abusing a logic error in HostEmulationManager.onNullBinding(). Exploitation requires user interaction but no extra execution privileges, and no public exploit has been identified at time of analysis.

Technical ContextAI

The flaw resides in HostEmulationManager.java, a component of Android's NFC Host Card Emulation (HCE) subsystem responsible for routing APDU traffic to off-host or on-host services. The onNullBinding() callback is invoked when a bound service returns a null IBinder; a logic error in this path lets a caller trigger an activity start while the originating app is in the background, bypassing Android's background-activity-launch restrictions introduced in Android 10+. Although NVD lists no CWE, the behavior fits CWE-269 (Improper Privilege Management) / CWE-1188 (Insecure Default Initialization of Resource) class issues tied to background-launch policy enforcement.

RemediationAI

Apply the Android security patch level 2026-06-01 or later as published in the Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-06-01); OEM-released builds incorporating this patch level are the authoritative fix. Patch available per vendor advisory, with exact post-patch build versions varying by device manufacturer - confirm via the device's Settings > About > Android security update field. As a compensating control until OEM builds arrive, restrict installation of untrusted apps (disable 'Install unknown apps' for all sources), enroll managed devices in MDM policies that block sideloading and require Play Protect, and consider disabling NFC on devices where HCE is not needed, accepting the trade-off of losing contactless payments and transit pass functionality.