Android CVE-2026-49937

Exploitation requires local access on the device: the attacker must already be running low-privilege code (PR:L), typically a locally installed or already-compromised application, and invoke the vulnerable MessageQueueBase code paths. No user interaction is required (UI:N) and no non-default configuration is indicated - any affected build (Android 14, 15, 16, 16-qpr2, 17) is susceptible. The primary limiting factor is the local attack vector (AV:L): there is no remote or network-facing exploitation path, so the attacker needs prior code execution on the target device, which substantially narrows realistic exposure to malicious-app or post-compromise scenarios.

CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attacker with low privileges (e.g., an installed unprivileged app) can exploit this with low complexity and no user interaction to achieve full confidentiality, integrity, and availability impact - consistent with a kernel/framework local privilege escalation on Android. The underlying flaw is an out-of-bounds read (CWE-119) from an incorrect bounds check in MessageQueueBase.h; an OOB read in isolation is primarily a confidentiality/info-leak primitive, so the I:H/A:H ratings imply Google assesses it as chainable into full privilege escalation rather than a pure read. No EPSS score, KEV listing, or POC reference was provided in the input, so exploitation probability cannot be quantified from this data. This is NOT confirmed as actively exploited and no public exploit was identified at time of analysis; the local attack vector (AV:L) meaningfully constrains real-world risk because an attacker must already have code execution on the device. Net: a legitimate patch priority for the current Android monthly cycle given the LPE impact and ubiquitous platform, but not an emergency remote threat - missing EPSS/KEV/POC signals mean widespread automated exploitation is unconfirmed.

A malicious or compromised low-privilege Android app invokes the affected MessageQueueBase functionality, triggering the incorrect bounds check to read out of bounds and leak adjacent memory. The attacker uses the leaked data (e.g., pointers or tokens) to defeat memory protections and escalate to higher privileges without any user interaction. No public proof-of-concept was identified in the provided data.