Google Android CVE-2026-0189

Requires local code execution on an affected Android/Pixel device: the attacker must run an unprivileged app or process that reaches the ac_init_policy initialization path in init.c. No authentication beyond app installation, no user interaction (UI:N), and no additional execution privileges are needed (PR:N per vector), which makes the local barrier low once any foothold exists. Limiting factors: exploitation is strictly local (no remote/network vector), it is scoped to devices running the affected Android/Pixel builds, and the attacker must first get code onto the device (e.g., a malicious app). No special non-default configuration is indicated.

This is a local Android privilege-escalation flaw (CWE-693 logic error in ac_init_policy of init.c) scored 8.4 by the vendor with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent and point to a genuine-but-locally-scoped issue rather than a mass-exploitation threat: the attack vector is Local (AV:L), so no network exposure exists, and exploitation requires an attacker to already be running code on the device. Notably, the vector sets PR:N and the description states 'no additional execution privileges needed' plus 'user interaction is not needed' - meaning an unprivileged local process can trigger the bypass, which justifies the elevated 8.4 despite the local vector. EPSS is very low at 0.13% (3rd percentile), there is no CISA KEV listing and no public POC, indicating no observed or predicted widespread exploitation. The C:H/I:H/A:H impact triad is somewhat generous for a permission-bypass EoP but is the standard Android bulletin scoring convention. Net: a legitimate patch-worthy local EoP but not an emergency internet-facing priority; it matters most in multi-app or malware-delivery threat models. No conflicting signals - the CVSS local vector matches the description's 'local escalation of privilege' wording.

A malicious or compromised low-privilege app installed on an affected Android/Pixel device invokes the flawed ac_init_policy logic path in init.c, exploiting the permission-bypass logic error to gain elevated privileges it was not granted. No user interaction and no additional execution privileges are required, so the escalation can happen silently in the background. No public exploit code has been identified at time of analysis.