EUVD-2026-74052
GHSA-rmpm-q647-ph72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on Android XR device
-
DeliveryApp invokes MicroXR Blobstore API
-
ExploitMissing permission check bypassed
-
ExecutionRead/access another app's private files
-
ImpactLocal privilege escalation / data disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a locally installed, attacker-controlled application running on an Android XR 14 device; exploitation is then unauthenticated in the sense of needing no special app permissions (PR:N per Android's model) and needs no user interaction. Limiting factors: the attacker must first get their app onto the device (physical or store/sideload delivery), the vector is local (on-device) rather than remote/network, and impact is confined to reading other apps' Blobstore files - this is NOT remotely exploitable against a network-exposed service despite the input vector's AV:N. |
| Impact | The supplied CVSS 4.0 score of 10.0 (AV:N/AC:L/PR:N/UI:N with full VC/VI/VA and subsequent-system SC/SI/SA all High) is grossly overstated and contradicts the description, which states 'local escalation of privilege' with 'no additional execution privileges needed.' A malicious app must already be installed and running on the device, so the true attack vector is Local (AV:L), not Network, and there is no evidence of any impact to a subsequent system (SC/SI/SA should be N). This is the same inflation pattern seen in other Android-family bulletins. Realistic impact is unauthorized read (and possibly write) of another app's files - a confidentiality-centric local EoP, not a remote system takeover. No EPSS, KEV, or POC data is provided; there is no public exploit identified, and no indication of active exploitation. Net: a genuine local sandbox-escape bug worth patching on affected devices, but far below the 10.0 emergency framing. |
| Exploit ScenarioDerived | A user installs a seemingly benign XR app from an untrusted source. Once running, that app calls into MicroXR Blobstore and, because the permission check is missing, retrieves files stored by another (e.g., higher-value) app - such as cached credentials, tokens, or private user data - without any prompt or user interaction. No public POC is identified at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. No public exploit identified at time of analysis; this is a Google/Android XR platform issue tracked in the September 2026 Android XR security bulletin.
RemediationAI
Apply the Android XR security patch level dated 2026-09-01 (or later) from the vendor advisory at source.android.com/docs/security/bulletin/xr/2026/2026-09-01; the bulletin does not expose a discrete semantic fix version, so this is best described as a patch available per vendor advisory rather than an exact tagged release. Devices should be updated to the September 2026 (or newer) Android XR security patch level. As interim compensating controls until the update is installed, restrict installation to trusted apps only (avoid sideloading and untrusted stores), since exploitation requires a locally installed malicious app; this reduces exposure at the cost of app-availability convenience but does not remove the underlying flaw. No standalone workaround is published by the vendor.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MicroXR Blobstore is the shared blob/data-storage subsystem of Android XR (Google's extended-reality platform, affected release Android XR 14). Android's security model isolates each app's files within its own sandbox; access to another app's data is meant to be gated by explicit permission checks. Here that check is absent, so the Blobstore serves another application's files to a caller that should not be authorized. The root cause maps to CWE-862 (Missing Authorization) / CWE-276 (Incorrect Default Permissions); the CVE lists CWE as N/A. The lone reference is the Android XR bulletin at source.android.com dated 2026-09-01.
Know when Android Xr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Requires a local malicious app (AV:L) with no special privileges/interaction (PR:N/UI:N); missing check exposes another app's files for read/write (C:H/I:H) with no availability impact and no scope change.
Primary rating from Vendor (android).
CVSS VectorVendor: android
DescriptionCVE.org
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android XR 14 devices in your fleet are vulnerable to data theft by any installed application due to a permission enforcement failure in the MicroXR Blobstore component. Malicious or compromised apps can silently access sensitive data stored by other applications-including credentials, personal information, and business data-without user awareness or system notification, and no patch currently exists to remediate this risk.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce mandatory Mobile Device Management (MDM) with strict application whitelisting on all Android XR 14 devices to minimize the number of potentially malicious applications present; disable USB debugging and app sideloading capabilities; implement network-level monitoring and segmentation to detect unusual data access patterns or network connections from affected devices; audit and catalog what sensitive data is currently stored on Android XR 14 applications and consider migrating that data to backend services not accessible to on-device applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB