EUVD-2026-74050
GHSA-5m72-phg9-cjgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on Wear OS device
-
ExploitInvoke affected read path in PermissionsManager
-
ExecutionBypass missing permission check
-
ImpactRead sensitive device state data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have code executing locally on the Wear OS device (an installed/co-resident application); exploitation then needs no granted permission, no elevated privileges, and no user interaction. Limiting factors: the attacker must first get an app onto the watch (via install/sideload/paired-companion delivery), the device must run an unpatched Wear OS 14/16/17 build predating the 2026-09-01 patch level, and impact is confined to reading sensitive device state (confidentiality) - it does not grant code execution, data modification, or remote network entry despite the CVSS AV:N label. |
| Impact | The signals conflict sharply. The supplied CVSS 4.0 vector reads 10.0 (AV:N/AC:L/PR:N/UI:N with VC/VI/VA:H and full subsequent-system impact SC/SI/SA:H), but the description explicitly describes LOCAL information disclosure with no execution privileges and no integrity or availability impact - the vector is grossly overstated and internally inconsistent with the text. A realistic reading is a local (AV:L), low-complexity, confidentiality-only issue: a malicious or curious app reading state it should not. There is no EPSS or SSVC data provided, the CVE is not listed in CISA KEV, and no public exploit is identified. Practical risk is moderate and gated on getting an app onto the watch; this is not a wormable remote-critical issue despite the 10.0 label. Treat the raw CVSS with skepticism and prioritize as a standard monthly Android/Wear patch item. |
| Exploit ScenarioDerived | An attacker convinces a user to install a seemingly benign Wear OS app (or bundles the payload in a companion-phone app that pushes a watch component). Once running locally with no special permissions, the app calls the affected read path, which skips the permission check in checkReadPermission and returns sensitive device state that the app was never authorized to see. No public PoC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. No public exploit identified at time of analysis, and the flaw is fixed in the September 2026 Wear security patch level.
RemediationAI
Patch available per vendor advisory: update affected Wear OS devices to the September 2026 Wear security patch level (2026-09-01) or later as delivered through the OEM/Google update channel; see https://source.android.com/docs/security/bulletin/wear/2026/2026-09-01 for the fixed builds. There is no configuration workaround inside Wear OS itself, so compensating controls focus on limiting untrusted code on the watch: install applications only from trusted sources, avoid sideloading APKs, and restrict which companion apps are paired, accepting the trade-off that this constrains legitimate app usage until the patched build is available. On managed fleets, enforce update compliance and block installation of unvetted apps via MDM.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect lives in Wear OS's PermissionsManager.java, the component that gates access to protected device state and content behind Android's permission model. The checkReadPermission routine omits (or short-circuits) the permission enforcement that should precede a read of sensitive device state, so a caller lacking the appropriate permission is not rejected. This is a classic missing/improper access-control weakness (aligning with CWE-276/CWE-284 and resulting in CWE-200-style information exposure), even though the input record lists CWE as N/A. Because the check is bypassed rather than the data being remotely exposed, exploitation is confined to code already running on the device.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description states local disclosure by an unprivileged app with no user interaction (AV:L/AC:L/PR:N/UI:N) exposing sensitive state (C:H), with no integrity or availability impact.
Primary rating from Vendor (android).
CVSS VectorVendor: android
DescriptionCVE.org
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android Wear devices running versions 14, 16, or 17 allow any installed application to access sensitive personal data (location, health metrics, device configuration) without required security permissions, creating a privacy and compliance exposure. No public exploit identified at time of analysis, but the local attack vector means any app on an employee's smartwatch or fitness tracker could covertly harvest protected information. Immediate patching is required to protect user privacy and organizational data governance.
Apply vendor patch. Until deployment completes, restrict third-party app installations on Wear OS 14, 16, and 17 devices and disable applications with access to sensitive personal data (health, location, authentication).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB