EUVD-2026-73992
GHSA-hg3v-6cg9-rg8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app (low-privilege)
-
DeliveryCall buildIntentSenderForUser with crafted arguments
-
ExploitObtain BAL-bypass PendingIntent
-
ExecutionLaunch arbitrary foreground activity from background
-
PersistOverlay or hijack privileged UI
-
ImpactEscalate access or harvest credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have a malicious application installed on the target Android device with at least standard installed-app (low) privileges - no additional system or root permissions are required. The device must be running Android 16, Android 16-QPR2, or Android 17. Exploitation does not require user interaction beyond initial app installation and requires no specific non-default configuration. Limiting factors: the attack is constrained to local execution (AV:L), meaning the malicious app must already be present on the device; remote unauthenticated delivery is not possible. Devices managed under strict MDM policies that prevent sideloading and enforce app allowlisting substantially reduce exposure. |
| Impact | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the attack surface: local access with low privilege but no special conditions or user interaction required after app installation, yielding full C/I/A impact. EPSS at 0.13% (3rd percentile) reflects very low current exploitation probability, consistent with SSVC's 'Exploitation: none' designation. SSVC's 'Automatable: no' aligns with AV:L - exploitation requires a locally installed app, which cannot be self-propagating over a network. However, SSVC's 'Technical Impact: total' matches the full C:H/I:H/A:H impact once exploitation succeeds. The combination of no KEV listing, no POC, low EPSS, and AV:L lowers real-world urgency compared to the raw CVSS score. Risk is highest on consumer devices outside enterprise MDM controls, where sideloaded malicious apps could silently exploit this to escalate privileges or conduct UI hijacking without any visible user prompt. |
| Exploit ScenarioDerived | An attacker distributes a malicious Android application - through a phishing link, third-party app store, or social engineering - that a user installs. Once installed and running in the background, the app calls the vulnerable |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Background Activity Launch (BAL) bypass in Android's LauncherAppsService allows a low-privilege local application to launch foreground activities from the background without user awareness or interaction. The flaw resides in buildIntentSenderForUser within LauncherAppsService.java, where authorization checks (CWE-863) are insufficient to prevent background callers from obtaining a valid intent sender that sidesteps Android's BAL restrictions. Affected versions include Android 16, Android 16-QPR2, and Android 17; no public exploit identified at time of analysis.
RemediationAI
Apply the Android security patches distributed via the September 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-09-01). Exact patched Android build numbers are not specified in the available data; consult the bulletin directly to confirm the security patch level (SPL) that addresses this CVE. For enterprise environments, enforce MDM policies that restrict sideloading of applications from unknown sources and require minimum SPL compliance, limiting the attack surface to apps distributed through vetted channels. No workarounds are identified for end-users unable to patch immediately; restricting device access to trusted applications is the most effective compensating control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Android's Background Activity Launch (BAL) restrictions are OS-level security controls introduced to prevent background processes from abruptly taking over the foreground UI - a technique commonly used in overlay attacks, credential phishing, and privilege escalation chains. The vulnerable method buildIntentSenderForUser in LauncherAppsService.java is a system service entry point used by launchers to construct PendingIntents on behalf of users. CWE-863 (Incorrect Authorization) confirms the root cause: the code grants the caller an authorized intent sender without adequately verifying that the caller's current execution context qualifies to bypass BAL restrictions. A malicious app holding only standard installed-app privileges can exploit this to launch arbitrary activities, potentially overlaying legitimate apps or triggering privileged UI flows without any user gesture. The CVSS vector AV:L/PR:L confirms local, low-privilege exploitation consistent with a rogue installed app scenario.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requires an installed app (PR:L, AV:L); no conditions or user interaction needed; full device impact once BAL bypass achieved.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 16, 16-QPR2, and 17 contain an authorization bypass in LauncherAppsService that allows locally-installed apps to launch foreground activities without user interaction; no public exploit identified at time of analysis. This creates significant risk for credential theft and unauthorized device manipulation affecting millions of Android device users.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce restrictive app permission policies to limit background activity capabilities; disable installation from unknown sources via device settings or EMM controls; implement device administration policies to monitor and restrict app runtime behavior; restrict user ability to sideload applications; establish clear app governance guidelines for corporate-issued Android devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB