Android CVE-2026-49935

Requires a locally present actor - a malicious or compromised app running on the device - that calls into LocaleManagerService's getXmlFileNameForUser; exploitation then relies on a confusable path traversal to defeat the service's permission/user-isolation check and disclose locale XML. No user interaction and no additional execution privileges are needed (PR:N/UI:N), but the AV:L vector means remote-only attackers cannot reach it: the attacker must already have local code execution on the target device. Impact is limited to read-only disclosure of low-sensitivity locale data (C:L, no integrity or availability impact). The limiting factors are therefore the local-access prerequisite and the narrow, low-value data exposed, which together keep real-world risk modest despite PR:N.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 base score of 4.0 (Medium) reflects AV:L (local attack vector - requires code already running on the device, i.e. a malicious or compromised local app), AC:L, PR:N, UI:N, and a limited impact profile (C:L/I:N/A:N - read-only disclosure of low-sensitivity data). EPSS reinforces low real-world urgency at 0.12% (2nd percentile), indicating no meaningful mass-exploitation pressure. There is no CISA KEV listing and no evidence of active exploitation in the provided data, so this is not confirmed actively exploited. No public exploit or PoC reference appears in the input (only the Android bulletin and the NVD advisory). The vuln.today decision label is 'this_month,' which aligns with the broader Android monthly patch cadence rather than signaling an out-of-band crisis. The one signal to note explicitly: the vector is AV:L (local), and the description confirms this by stating 'local information disclosure' with 'no additional execution privileges needed' - these are consistent, so there is no network-vs-local conflict here. Overall: a legitimate but low-severity local info-disclosure bug appropriate for routine monthly patching.

A malicious or low-privilege app already installed on the device abuses a confusable path traversal in LocaleManagerService's getXmlFileNameForUser routine to bypass the intended permission/user boundary and read locale configuration XML it should not have access to (e.g. belonging to another user or profile). Because the CVSS vector is AV:L/PR:N/UI:N, exploitation needs local code execution but no special privileges and no user interaction. No public exploit code is identified in the available data.