Google Android CVE-2026-45524

Exploitation requires a locally-present, low-privileged application on the device (PR:L, AV:L) that can reach the isSystem() code path in WifiPermissionsUtil.java; the missing permission check lets that app escape its sandbox and escalate to system privileges. No user interaction is required (UI:N) and no non-default configuration is indicated - the flaw is in the platform code itself. Limiting factors: the attacker must already achieve local code execution (e.g. a malicious or compromised app installed on the device), and only Android 17 is listed as affected, so devices on other versions or those that have applied the October 2026 patch level are not exposed.

This is a credible, high-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.8) indicates a locally-launched attack with low complexity, requiring only low privileges (i.e. an already-installed, low-privileged app), no user interaction, and a scope change - the hallmark of a sandbox escape where a malicious app breaks the Android app-sandbox boundary. CWE-862 (missing authorization/permission check) is consistent with the description's 'missing permission check' in isSystem(). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by severity and exploitability, not by observed exploitation. The signals are internally consistent (no CVSS-vs-description conflict), but note one gap: because this is a local app-to-system escalation, real-world risk depends on a malicious or compromised app already running on the device, which is the normal threat model for Android EoP bugs. Treat as a standard-to-urgent patch item in the Android monthly cadence rather than an emergency remote-RCE scenario.

A user installs a malicious or trojanized app that holds only ordinary low-level privileges. The app invokes the flawed isSystem() path in WifiPermissionsUtil without triggering the missing permission check, escaping its sandbox to gain system-level privileges - all with no user interaction and low attack complexity (AV:L/AC:L). No public POC is referenced in the available data.