Google Android CVE-2026-49924

Exploitation requires local access: the attacker must already be able to execute code on the device (e.g., a malicious or compromised installed application) that can create unauthorized shortcuts handled by ShortcutInfo.java. Given AV:L/AC:L/PR:N/UI:N, once local code execution exists no further privileges, no authentication, and no user interaction are needed, and default configurations are affected. The limiting factors are substantial: there is no remote attack surface (AV:L), the only impact is availability (a launcher crash - local denial of service with no confidentiality or integrity effect), and the attacker must first achieve app installation or local execution on the targeted device.

This is a genuine but low-urgency issue - a high-CVSS-feel that resolves to moderate real-world risk. The CVSS 3.1 score of 6.2 (MEDIUM) is driven entirely by availability impact (A:H) with no confidentiality or integrity loss (C:N/I:N), and the attack vector is explicitly local (AV:L), meaning an attacker must already be able to run code or install an app on the device. Although PR:N/UI:N indicate no privileges and no user interaction are required at the point of exploitation, the local vector means the practical precondition is a malicious or compromised app already present on the device. The signals align consistently rather than conflict: EPSS is very low (0.11%, 1st percentile), there is no CISA KEV listing, and no public exploit or PoC reference is provided - all consistent with a low-probability, low-consequence (crash-only) defect. The vuln.today decision label is 'this_month', not act_now or emergency, matching the SSVC-style read that technical impact is partial (availability only) and this is not automatable remote exploitation. Bottom line: a legitimate bug to patch on the normal monthly Android cadence, not a drop-everything priority; the worst outcome is a launcher crash (local DoS), not code execution or data exposure.

A malicious or low-privilege app installed on an Android device registers or pushes an excessive/unauthorized set of shortcuts, exhausting resources in ShortcutInfo handling and crashing the system launcher, producing a local denial of service. No user interaction is required and no additional execution privileges are needed, but the attacker must already have local code execution (e.g., an installed app). No public PoC or exploit code is referenced.