Android Bootloader CVE-2026-0192

Exploitation requires the attacker to already possess Android System execution privileges (PR:H) and local access to the device (AV:L); it targets a bootloader operation that is missing a required permission check (CWE-862). No user interaction is required (UI:N). The critical limiting factor is the System-privilege prerequisite - this is not reachable by an ordinary unprivileged app or remotely, so it functions as a second-stage escalation from an already-privileged foothold rather than an initial-access vector.

This is a genuine-but-modest local privilege escalation, not a high-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) shows local access with HIGH privileges already required - the description confirms this: exploitation needs 'System execution privileges.' That means the attacker must already be running as the highly-privileged Android System user before they can leverage this missing bootloader permission check; the actual privilege gain over an already-System attacker is therefore limited, which makes the C:H/I:H/A:H triad look generous relative to the 6.7 base score. Exploitation signals reinforce low urgency: EPSS is 0.11% (2nd percentile), there is no CISA KEV listing and no public exploit code. No SSVC decision data is provided. The one meaningful counterweight is that bootloader-level flaws can matter for verified-boot/secure-boot integrity, so the impact ceiling is real even if the access prerequisite is steep. Net: a legitimate patch-in-cycle bootloader hardening fix, not a widely-exploitable threat.

A local process or component already operating with Android System execution privileges invokes a bootloader interface that fails to enforce a required permission check, allowing it to perform a privileged operation it should not be authorized for. No user interaction is required. No public proof-of-concept or exploit code is identified at time of analysis.