Android CVE-2026-45528

Requires a malicious application to be installed on the target device with at least user-level (low privilege) execution - this is the primary gatekeeping condition. User interaction is required: the victim must actively navigate to the Manage Space flow for an application in the device Settings, causing StorageManagerService to generate and dispatch the vulnerable PendingIntent. Exploitation is strictly local (AV:L); network-based or zero-click remote exploitation is not possible for this vulnerability. The SSVC assessment confirms the attack is not automatable. Limiting factors include: the requirement for the victim to take a specific UI action, the need for a malicious app to already be present on the device, and restriction to Android 14-17 (earlier versions are not listed in the advisory).

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) accurately reflects the attack profile: exploitation requires an installed malicious app, user-triggered navigation into storage management, and physical device access, all of which constrain real-world exploitability. The EPSS score of 0.12% (2nd percentile) and SSVC exploitation status of 'none' are internally consistent and indicate no current active exploitation. Despite the SSVC rating of 'Technical Impact: total,' the non-automatable nature of the attack (requires user interaction, cannot be chained remotely) meaningfully reduces urgency - even a mid-sized municipal IT team in legnica managing a mixed Android BYOD fleet should treat this as a standard patch-cycle priority rather than an emergency, absent evidence of targeted in-the-wild use. The breadth of affected versions (Android 14-17) across billions of devices does, however, make this a high-aggregate-risk finding even at low individual-exploitation probability.

An attacker distributes a trojanized Android application - disguised as a utility or game - that a victim installs on their Android 14-17 device; when the victim subsequently opens the system storage management interface (for example, via Settings → Apps → select any app → Manage Space), StorageManagerService generates the vulnerable PendingIntent and delivers it in a way the malicious app can intercept. The attacker's app modifies the intent to redirect the activity launch to a privileged system component, gaining full access to device data, credentials, and settings without requiring any additional permissions beyond those already held by the malicious app.