EUVD-2026-74050
GHSA-5m72-phg9-cjgm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description states local disclosure by an unprivileged app with no user interaction (AV:L/AC:L/PR:N/UI:N) exposing sensitive state (C:H), with no integrity or availability impact.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already have code executing locally on the Wear OS device (an installed/co-resident application); exploitation then needs no granted permission, no elevated privileges, and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: update affected Wear OS devices to the September 2026 Wear security patch level (2026-09-01) or later as delivered through the OEM/Google update channel; see https://source.android.com/docs/security/bulletin/wear/2026/2026-09-01 for the fixed builds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Wear OS 14, 16, and 17 devices across your organization and document which are company-managed and which are BYOD. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today