Google Android CVE-2026-55272

Local access to the device is required (CVSS AV:L): exploitation needs code running on the device, typically a malicious or compromised application, since the Android bulletin context and local vector indicate an on-device actor rather than a remote one. No user interaction (UI:N) and no additional execution privileges (PR:N) are needed per the description and vector. The flaw is reached via a resource-exhaustion condition that bypasses a permission check in 'multiple places'; the exact feature, API, or configuration that triggers it is not described in the available sources. Limiting factors: impact is confined to local denial of service (A:H only; C:N/I:N) with scope Unchanged, affects only Android versions 14 through 17 (including 16-qpr2), and requires the attacker to already have local execution on the target device.

Signals align toward a moderate, low-urgency issue rather than a top priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.2) describes a local, low-complexity availability-only impact with no confidentiality or integrity loss - i.e. a denial-of-service, not code execution or data theft. EPSS is very low at 0.14% (3rd percentile), the CVE is NOT in CISA KEV, and no public exploit is identified, so there is no evidence of active or imminent exploitation. The vuln.today decision label is 'this_month' (routine patch cadence), not act_now or emergency, consistent with the low EPSS and absence of KEV. One point worth verifying: although the CVSS encodes PR:N (no privileges), the attack vector is Local (AV:L), which in the Android model typically means a malicious or compromised app already present on the device - so 'no privileges' refers to app-level execution context, not remote access. The CVSS A:H (high availability impact) somewhat overstates the real-world consequence described (local DoS of the affected device/component only, scope Unchanged). Net: a legitimate but non-urgent hardening fix for a local DoS.

A user installs a malicious or compromised app that, without requesting special permissions or any user interaction, triggers a resource-exhaustion condition that bypasses a permission check and crashes or renders a component unavailable, causing a local denial of service on the device. No public exploit code has been identified, and the attack affects only the local device with no confidentiality or integrity impact.