EUVD-2026-37187
GHSA-fxj3-3pgg-7c94
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Local privilege escalation in the Android kernel's msg_to_host_buffer.cc component allows a low-privileged local process to corrupt memory via an out-of-bounds write, gaining elevated privileges without user interaction. The flaw stems from an incorrect bounds check on a host buffer write path and carries a CVSS 7.8 (High) rating with total technical impact. No public exploit has been identified at time of analysis, and CISA's SSVC framework marks exploitation as none, consistent with the very low EPSS score (0.11%).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Google_Devices) · only source for this CVE.
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
2DescriptionCVE.org
In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A high-severity vulnerability in the Android kernel (CVE-2026-0153, CVSS 7.8) could allow individuals with local device access to escalate privileges and take full control of affected Android phones and tablets. While no active exploitation has been identified and current threat likelihood remains low (0.1% EPSS), any organization with Android device deployments should prepare for patch deployment once vendors release fixes to prevent future compromise of sensitive device data.
Within 24 hours: Conduct an inventory of Android devices across your organization and document their kernel versions and installed security patches. Within 7 days: Deploy monitoring and alerting for privilege escalation attempts on Android endpoints, and coordinate with your device manufacturers to determine patch timelines. Within 30 days: Establish a tested deployment plan for kernel security updates once vendor patches become available, prioritizing devices used for business-critical functions or those accessing sensitive data.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting local access to Android devices through physical and logical controls; implementing application-level authorization and sandboxing to limit privilege escalation impact; enabling forensic logging to detect exploitation attempts; and maintaining a readiness posture for rapid patch deployment upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB