EUVD-2026-73996
GHSA-536m-8xwr-6r8p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Race condition exploitation requires winning a timing window (AC:H); local low-privilege access needed (AV:L/PR:L); only partial confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
5DescriptionCVE.org
In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local information disclosure in Android's MediaProvider component affects Android 14 through 17 via a race condition in updateInternal of MediaProvider.java. An unprivileged local application can exploit a time-of-check-time-of-use (TOCTOU) window during a media record update operation to read file contents that should not be accessible, without requiring elevated privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have a locally installed application running on the target Android device with at least standard (low-privilege) user permissions - no root or system-level access is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.3 (Low) rating is consistent with the bounded real-world risk: the attack vector is local (AV:L), a low-privilege app is required (PR:L), and impact is limited to partial confidentiality (C:L) with no integrity or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the September 2026 Android Security Bulletin patch, available via the Android monthly security update for affected devices. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today