Android Kernel CVE-2026-0194

Requires local code execution on the affected Android/Pixel device - the attacker must already be able to run code (e.g. an installed malicious or compromised app) because the vector is AV:L, not remote. Given PR:N/UI:N, once running locally the overflow can be triggered with no additional execution privileges and no user interaction, per the description. Limiting factors: exploitation is confined to the local device (no network reach), requires a delivery mechanism to get code onto the device in the first place, and is closed on devices that have applied the 2026-09-01 Pixel/Android security patch; specific vulnerable versions/components are not enumerated beyond 'Android kernel'.

Signals are internally consistent and point to a genuine but locally-scoped issue rather than an internet-facing crisis. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a local, low-complexity, unauthenticated, no-interaction integer overflow (CWE-190) that bypasses a permission check to escalate privilege on Android; the 'HIGH' base score is driven by the local-EoP full C:H/I:H/A:H impact triad that Google applies as boilerplate to Android escalation flaws. Against this, EPSS is very low at 0.12% (2nd percentile), there is no CISA KEV listing and no public POC, so no evidence of active or imminent mass exploitation exists. Note AV:L means this is NOT remotely reachable - an attacker must already be running code on the device (typically a malicious or compromised local app), so despite the high number it is a local privilege-escalation primitive, not a remote takeover. The description says 'multiple locations' and gives no component detail, so the exact code path and the C/I/A impact scope cannot be independently verified and rest on the vendor's self-assessment. No signals conflict; the picture is a real, patch-worthy local EoP of moderate operational urgency, best handled through the normal Android/Pixel monthly patch cycle rather than as an emergency.

A user installs a malicious or trojanized app (or an attacker gains a low-privilege foothold via another bug); the app triggers the integer overflow in the vulnerable code paths to bypass a permission check and, with no user interaction, elevates to higher privileges on the device. No public exploit code has been identified at time of analysis, and exploitation requires local code execution on the target device.