What is the CVSS score of CVE-2026-0153?

CVE-2026-0153 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google are affected by CVE-2026-0153?

A high-severity vulnerability in the Android kernel (CVE-2026-0153, CVSS 7.8) could allow individuals with local device access to escalate privileges and take full control of affected Android phones…

How to fix or mitigate CVE-2026-0153?

Within 24 hours: Conduct an inventory of Android devices across your organization and document their kernel versions and installed security patches. Within 7 days: Deploy monitoring and alerting for privilege escalation attempts on Android endpoints, and coordinate with your device manufacturers to determine patch timelines. Within 30 days: Establish a tested deployment plan for kernel security updates once vendor patches become available, prioritizing devices used for business-critical functions or those accessing sensitive data.

Google CVE-2026-0153

EUVD-2026-37187 HIGH

Out-of-bounds Write (CWE-787)

2026-06-16 Google_Devices

GHSA-fxj3-3pgg-7c94

Privilege Escalation Buffer Overflow Google Memory Corruption

7.8

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from CISA-ADP · only source for this CVE.

CVSS VectorCISA-ADP

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:08 vuln.today

CVE Published

Jun 16, 2026 - 18:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 16, 2026 - 18:51 cve.org

HIGH 7.8

DescriptionCVE.org

In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in the Android kernel's msg_to_host_buffer.cc component allows a low-privileged local process to corrupt memory via an out-of-bounds write, gaining elevated privileges without user interaction. The flaw stems from an incorrect bounds check on a host buffer write path and carries a CVSS 7.8 (High) rating with total technical impact. No public exploit has been identified at time of analysis, and CISA's SSVC framework marks exploitation as none, consistent with the very low EPSS score (0.11%).