Google Android CVE-2026-55264

Requires a locally installed, unprivileged application on the Android device (AV:L, PR:N, UI:N): the attacker-controlled app calls DownloadProvider and exploits the flawed checkWhetherCallingAppHasAccess logic to have DownloadProvider act as a confused deputy and return download information the calling app is not authorized to access. Exploitation is limited to devices running Android 14 through 17 (including 16-qpr2) that have not yet applied the November 2026 security patch level, and the attacker must already achieve code execution via an installed app - there is no remote or network-reachable path. Impact is confined to information disclosure (C:L); no code execution, privilege escalation, or data modification results.

This is a genuinely low-priority issue despite being a confirmed Android platform vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.0) consistently indicates LOCAL attack vector - a malicious app already present on the device - with no privileges and no user interaction required, but only LOW confidentiality impact and zero integrity/availability impact. All real-world exploitation signals agree with this low rating: EPSS is 0.11% (1st percentile), there is no CISA KEV listing (no_public_exploit active-exploitation evidence), and no PoC or exploit reference appears anywhere in the input. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with routine patch-cycle handling. No signals conflict here: a local-only information-disclosure confused-deputy flaw with bottom-percentile EPSS and no exploitation evidence is a maintenance-grade fix, not an urgent one. The one caveat is that AV:L plus PR:N means any sideloaded or installed app can attempt it without a prompt, so on devices that run untrusted apps the barrier is lower than the CVSS base score alone suggests.

A user installs a malicious or over-permissioned app that has no legitimate right to another app's download data. By invoking the DownloadProvider through the flawed checkWhetherCallingAppHasAccess path, the app abuses DownloadProvider as a confused deputy to read download information it should not be able to see. No user interaction or additional privileges are required, and no public exploit code is identified at time of analysis.