Google Android CVE-2026-55263

Exploitation requires an attacker-controlled app already present and running locally on the device (AV:L) that invokes AllowBindAppWidgetActivity, plus active user interaction: the victim must be deceived by the misleading or insufficient consent UI into approving an app-widget bind they intended to reject (CWE-451). Limiting factors: no remote network reachability, a malicious app must first be installed, and success depends on the user actually being fooled by the dialog, so it cannot be triggered silently or automatically. It affects Android 14 through 17 (including 16-qpr2); devices patched per the 2026-11-01 bulletin are not exposed.

Signals are mixed and point to a moderate, not emergency, priority. The published CVSS of 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this High, but note a direct conflict: the vector encodes UI:N (no user interaction) while the description explicitly states 'User interaction is needed for exploitation' - one of these is wrong, and the description (consistent with CWE-451, UI misrepresentation) strongly implies UI:R, which would lower the true base score. The attack vector is local (AV:L), so this is not remotely reachable: an attacker needs code already running on the device (typically a malicious installed app). EPSS is very low at 0.11% (1st percentile), the CVE is not on CISA KEV, and no public exploit is identified, so there is no evidence of active or imminent exploitation. SSVC-style framing: exploitation is none/unverified, impact is high-but-local, and automatability is low because it hinges on tricking a human through a misleading consent dialog. The vuln.today decision label is 'this_week' rather than act_now/emergency. Net: a legitimately high-severity local EoP that should be patched on the normal Android monthly cadence, but it is not a drop-everything issue - it is driven by severity rating, not by real-world exploitation pressure.

A user installs a malicious or compromised app that invokes AllowBindAppWidgetActivity and presents a misleading or ambiguous consent dialog, causing the user to approve a widget-bind action they believe they are rejecting. The mistaken consent grants the app elevated capability it should not have, achieving local privilege escalation with no additional execution privileges. No public exploit is identified at time of analysis, and because success depends on deceiving a human, exploitation is not automatable.