EUVD-2026-73990
GHSA-4cw6-2xfr-c3x9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local attack requiring installed-app privileges; only partial confidentiality loss from session data read; no integrity or availability impact.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
5DescriptionCVE.org
In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local information disclosure in Android's getAllSessions function across multiple files allows a low-privileged application to obtain session data it is not authorized to access, exploiting a confused-deputy logic error in the code. Affected versions span Android 15, 16, 16-qpr2, and 17, as documented in the September 2026 Android Security Bulletin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a malicious application to be installed and running on the target Android device with at least low-privilege user context (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk here is genuinely low across every available signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the September 2026 Android Security Patch Level (SPL 2026-09-01) or later as documented in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-09-01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today