Android AccountManager CVE-2026-49923

Exploitation requires local access to the device (AV:L) - in practice a malicious app installed and running on the affected Android device that interacts with the AccountManager framework; the vulnerable code path is AccountManagerService.onResult, where a logic error produces an untrusted or misleading UI/result. Per the CVSS vector no privileges (PR:N) and no user interaction (UI:N) are required, and the description states no additional execution privileges are needed. The limiting factor is the local vector: there is no remote network reachability, so the attacker must already have code execution on the device. Affected builds are Android 14, 15, 16, 16-qpr2 and 17; the precise triggering sequence beyond the onResult logic error is not described in the available sources.

This is a locally-exploitable Android privilege-escalation flaw (CVSS 3.1 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in AccountManagerService, graded by Google as full compromise of confidentiality, integrity and availability. The signals are internally consistent on severity but modest on urgency: the CVSS vector is local (AV:L), not network, so this is not remotely reachable - an attacker must already be able to run code on the device (typically a malicious installed app). SSVC reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=total; the vuln.today decision label is 'this_week', i.e. prompt but not emergency. There is no CISA KEV listing and no EPSS score was supplied, and no PoC or exploit reference appears in the input, so exploitation likelihood cannot be quantified from the data. Note a mild tension worth verifying: the root cause is CWE-451 (misleading/untrusted UI) and the description frames it as a 'misleading UI issue,' yet the vector asserts UI:N (no user interaction) and full C:H/I:H/A:H impact - the mechanism by which a UI-spoofing logic error yields total technical impact without user interaction is not explained in the available sources. Overall this is a genuine high-severity local EoP to patch promptly, but the local-only vector and absence of exploitation evidence place it below network-reachable or actively-exploited criticals.

A malicious or compromised app already present on the device invokes AccountManager flows and leverages the logic error in AccountManagerService.onResult so that an untrusted or misleading UI/result is presented or trusted, allowing the app to escalate its privileges locally without any user interaction or additional execution privileges. No public exploit code is identified at the time of analysis, and because the attack vector is local (AV:L), the attacker must first get code running on the device.