Google Android CVE-2026-49931

Exploitation requires a locally present, attacker-controlled app on the device (AV:L) and a device configured with a protected/secondary profile (e.g., work profile or managed-profile separation) holding the contact data to be leaked - without a second profile there is no cross-profile boundary to breach. The flaw is reached through the affected onActivityResult handler acting as a confused deputy, so the attacking app must be able to invoke that activity-result flow; per CVSS PR:N and UI:N, no granted privileges and no user interaction are needed once the app is installed. Limiting factors: the attack cannot be performed remotely or against default single-profile devices lacking the protected-profile data, and the attacker must first achieve app installation on the target.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a locally-exploitable confused-deputy flaw (CWE-441) requiring no privileges and no user interaction, which makes it trivially reachable by any installed app. However, the CVSS impact triad (C:H/I:H/A:H) is inconsistent with the described effect: the description states only a contact leak from a protected profile, which is fundamentally a confidentiality exposure, not an integrity or availability compromise - this over-rates impact and should be verified against the Android bulletin severity. No EPSS score was supplied, Android/Google did not list this in CISA KEV, and no PoC or exploit reference is present, so exploitation signals are absent beyond the vendor report. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a locally-scoped privacy flaw that requires attacker-controlled code already on the device rather than a remotely-wormable issue. Net assessment: real but bounded risk - meaningful on multi-profile/work-profile devices where cross-profile contact isolation matters, but it is a local privilege/privacy escalation gated on prior app installation, not a remote or mass-exploitation priority.

A malicious or compromised app installed on an Android device with a separate protected (e.g., work) profile abuses a vulnerable onActivityResult handler that acts as a confused deputy, causing a privileged component to return contact data belonging to the protected profile to the unprivileged caller. No user interaction and no additional permissions are required, so the leak occurs silently once the app triggers the vulnerable activity-result flow. No public exploit was identified at time of analysis.