EUVD-2026-73978
GHSA-p5p8-9rh6-6rhf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local exploit via installed low-priv app, no user interaction; confused deputy grants full install bypass enabling high CIA impact.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
4DescriptionCVE.org
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Privilege escalation in Android's PickActivity allows any installed low-privileged application to silently bypass the 'Install unknown apps' security restriction, enabling unauthorized APK installation without user consent across Android 14, 15, 16, and 16-QPR2. The root cause is a confused deputy flaw (CWE-441) in the setupLayout method of PickActivity.java, where the privileged activity can be manipulated into performing installation actions on behalf of a less-privileged caller, circumventing a core Android security boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have a malicious application already installed on the target device operating with standard low-privilege user-level permissions (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N reflects a locally exploitable flaw requiring only a standard installed application - a realistic attacker position achievable through social engineering or a benign-appearing store submission. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the September 2026 Android Security Bulletin patches (security patch level 2026-09-01 or later) as published at https://source.android.com/docs/security/bulletin/2026/2026-09-01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify the scope of Android devices running Android 14, 15, 16, or 16-QPR2 in your environment (both corporate-managed and BYOD programs) and assess the attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today