EUVD-2026-115566
GHSA-8g2x-mh8j-gr9x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall low-privileged local app
-
ExploitAbuse misleading USB dialog handling
-
ImpactEscalate to higher privileges on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires local access to the device, specifically code running on the Android handset that interacts with the USB dialog path in UsbDialogHelper (AV:L). The limiting factor is this local foothold - typically a malicious or compromised app already installed on the device - rather than any remote reachability; the flaw cannot be triggered over the network. Per the vector no elevated privileges (PR:N) and no user interaction (UI:N) are needed, so a low-privileged local app against a default configuration appears sufficient, though the exact feature state or USB mode that surfaces the misleading dialog is not detailed in the available sources. Affected releases are Android 14, 15, 16, 16-qpr2 and 17; devices on other versions are outside the stated scope. |
| Impact | Signals here point to a real but non-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) describes a locally-exploitable privilege escalation with total confidentiality, integrity and availability impact (base 8.4), and the SSVC Technical Impact of 'total' agrees with that high impact. However, the exploitation signals pull the other way: SSVC records Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, no EPSS value was supplied, and no public exploit is referenced. The Android bulletin priority maps to a 'this_week' decision label rather than an emergency, consistent with a high-impact-but-not-currently-exploited flaw. Note an internal tension worth verifying with the vendor: CWE-451 (UI misrepresentation) and the description's 'UI confusion due to misleading or insufficient UI' typically imply a user is deceived, yet the same description states user interaction is not needed (UI:N) - confirm with Google how the misleading dialog is reached without interaction. EPSS is absent, not low, so no widespread-vs-targeted inference can be drawn. |
| Exploit ScenarioDerived | A malicious application already present on the device abuses the misleading or insufficient USB dialog handled by UsbDialogHelper to obtain privileges it was not granted, without needing the user to approve an action. Because the flaw is local (AV:L) and requires no added execution privileges, a low-privileged app on the handset is the realistic attacker. No public exploit code is referenced in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Local privilege escalation in the Android framework's UsbDialogHelper component, caused by misleading or insufficient UI (CWE-451) in the USB dialog path, affecting Android 14, 15, 16, 16-qpr2 and 17. Per the assessed vector (AV:L/AC:L/PR:N/UI:N), code already running on the handset can trigger the flaw without elevated privileges and without user interaction, yielding high confidentiality, integrity and availability impact; network reachability does not apply. Exploitation status is none per SSVC and no public exploit has been identified at time of analysis, so this is a real but non-urgent priority for the current week rather than an emergency.
RemediationAI
Patch status is: patch available per vendor advisory - the Android Security Bulletin of 2026-11-01 (https://source.android.com/docs/security/bulletin/2026/2026-11-01) is the authoritative source and should be used to obtain the exact patch level and build identifiers for Android 14, 15, 16, 16-qpr2 and 17, as no individual fix version string is given in the supplied data. Because exploitation requires code already running locally on the device (AV:L) with no additional privileges or user interaction, the practical exposure window is governed by which applications can execute on the handset; the supplied sources do not document any vendor-provided workaround or configuration mitigation for this issue, so applying the bulletin update is the remediation step of record, and the decision signal here places it in this week's remediation queue rather than an emergency response.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in UsbDialogHelper.java, part of the Android framework code that mediates the dialogs presented around USB device and accessory handling - the UI layer through which the platform communicates what a USB connection or request means before access is granted. The assigned weakness class, CWE-451 (user interface misrepresentation of critical information), describes a UI that misleads about, or omits, information a user or the system needs to make a correct trust decision; here the dialog is described as misleading or insufficient, which in turn permits an escalation of privilege. The provided sources do not describe the specific trigger, the exact USB mode or feature state that surfaces the misleading dialog, or the code path by which the dialog outcome translates into elevated access, so the precise mechanism is not described in the available sources. Affected products are identified by the CPE cpe:2.3:a:google:android, with EUVD listing Android 14, 15, 16, 16-qpr2 and 17; the CVSS metrics (AC:L, PR:N, UI:N, S:U, C/I/A:H) indicate the severity of the outcome once the local precondition is met and do not by themselves describe how the condition is reached.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app-to-OS privilege escalation (AV:L), no prerequisites or interaction per the description (PR:N/UI:N), and SSVC 'total' technical impact supports C:H/I:H/A:H.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
CVE-2026-55257 is a high-severity local privilege escalation in Android's USB dialog handling that allows malicious apps already on a device to gain elevated access without user interaction. Affected devices include those running Android 14, 15, 16, 16-qpr2, and 17, meaning a broad swath of the enterprise mobile fleet is exposed. While no active exploitation has been observed, the lack of a vendor patch makes this a priority for the current week and a key consideration for mobile threat defense and BYOD risk policies.
No vendor patch available. Interim mitigations: enforce strict app installation controls (block sideloading and unknown sources), enable Google Play Protect and mobile threat defense, disable USB debugging and unnecessary USB transfer modes via MDM policy, reduce the attack surface by prohibiting untrusted apps, and closely monitor for anomalous privilege escalation behavior on managed devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB