Google Android CVE-2026-49880

Exploitation requires local code execution on the device: the attacker must run a low-privilege application (PR:L) that can reach the NFC Execution Environment (NFCEE) message-handling code paths in nfa_nfcee_act.cc. No user interaction is required (UI:N) and the flaw is remotely unreachable (AV:L) - it cannot be triggered over the network. Limiting factors: the attacker needs an already-installed/running local app, the device must run an affected build (Android 16, 16-qpr2, or 17) without the 2026-10-01 security patch, and reliable escalation must overcome Android's native-code exploit mitigations; devices with the October 2026 patch applied are not exploitable.

Signals are consistent and point to a genuine but non-urgent local privilege-escalation issue rather than a remotely-exploitable emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms this is a LOCAL attack requiring the attacker to already have some privilege on the device (PR:L, e.g. a malicious or compromised local app), with no user interaction and low complexity, yielding total impact (C:H/I:H/A:H). This aligns with CISA's SSVC assessment of Technical Impact: total but Automatable: no (local-only flaws cannot be mass-automated via reconnaissance/weaponization) and Exploitation: none. EPSS reinforces this: 0.11% probability at the 1st percentile indicates no meaningful signal of imminent exploitation. There is no KEV listing and no known public exploit. The one caveat worth verifying: the memory-safety nature (CWE-119 out-of-bounds write in native C++ NFC code) means real-world exploitability depends on reachability of the vulnerable NFCEE code path and the effectiveness of Android exploit mitigations - the 'total impact' rating assumes successful code execution, which modern mitigations may hinder. Net: a real patch-worthy priority on affected Android versions, but not a drop-everything issue absent active exploitation.

A malicious or already-compromised application running locally on an affected Android device interacts with the NFC Execution Environment (NFCEE) handling code so that a crafted/oversized message reaches the vulnerable functions in nfa_nfcee_act.cc, triggering an out-of-bounds write. Because the write occurs in a privileged native system component, the attacker leverages the memory corruption to escalate from their current low privilege to system/elevated privileges without any user interaction. No public exploit code has been identified at time of analysis, and the low attack complexity (AC:L) means a working primitive, once developed, would be reliable.