Google Android CVE-2026-49885

Exploitation requires local access via a low-privilege context (PR:L) on an affected Android device (14 through 17) that can route attacker-controlled NFC Type 4 Tag data into rw_t4t_update_file; no user interaction is required (UI:N) and the integer overflow then produces the out-of-bounds write. Limiting factors: the attacker must already have local code execution/app presence on the device, exploitation depends on reaching the NFC reader/writer code path (NFC functionality must be exercised), and the device must be running an unpatched build predating the 2026-10-01 Android bulletin fix. There is no remote network vector (AV:L), which meaningfully constrains real-world reach.

This is a genuine, actionable priority for Android fleet patching but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a locally-exploitable integer overflow (CWE-190) in rw_t4t.cc - Android's NFC Type 4 Tag reader/writer in the native NFC stack - requiring low privileges (PR:L, consistent with a malicious/compromised local app) and no user interaction, yielding full C:H/I:H/A:H impact via local privilege escalation. The 7.8 base score reflects high impact gated by local access rather than remote reach. No EPSS score, KEV listing, or POC was supplied in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a tension worth flagging: the component is NFC tag parsing, which can be reached by proximity to a crafted tag, yet the vector is AV:L (not AV:P/AV:A) - this implies the realistic trigger path is a local process feeding attacker-controlled tag data rather than a purely over-the-air attack; verify the exact reachability with the Android bulletin. Overall: treat as a standard high-severity Android monthly-bulletin LPE - important because the product is ubiquitous, but lacking the exploitation signals that would make it a drop-everything fix.

A malicious or compromised low-privilege app on an Android device supplies crafted Type 4 NFC tag data that reaches rw_t4t_update_file, where an integer overflow causes an out-of-bounds write in the NFC native stack. With no user interaction required, the attacker corrupts memory in a higher-privileged context to escalate privileges on the device. No public proof-of-concept was provided in the available intelligence.