EUVD-2026-74052
GHSA-rmpm-q647-ph72
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a local malicious app (AV:L) with no special privileges/interaction (PR:N/UI:N); missing check exposes another app's files for read/write (C:H/I:H) with no availability impact and no scope change.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a locally installed, attacker-controlled application running on an Android XR 14 device; exploitation is then unauthenticated in the sense of needing no special app permissions (PR:N per Android's model) and needs no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 score of 10.0 (AV:N/AC:L/PR:N/UI:N with full VC/VI/VA and subsequent-system SC/SI/SA all High) is grossly overstated and contradicts the description, which states 'local escalation of privilege' with 'no additional execution privileges needed.' A malicious app must already be installed and running on the device, so the true attack vector is Local (AV:L), not Network, and there is no evidence of any impact to a subsequent system (SC/SI/SA should be N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Android XR security patch level dated 2026-09-01 (or later) from the vendor advisory at source.android.com/docs/security/bulletin/xr/2026/2026-09-01; the bulletin does not expose a discrete semantic fix version, so this is best described as a patch available per vendor advisory rather than an exact tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Android XR 14 devices across your organization and create an inventory of business-critical and sensitive applications deployed on them. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Android Xr
View allSame weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today