Android CVE-2026-55273

Exploitation requires local code execution on an affected Android device with at minimum low-privilege app-level access (consistent with PR:L in the CVSS vector). The attacker must be able to supply crafted input to the AppendCommentLine function of AnnotationProcessor.cpp - which may require either running in a build environment context or triggering the annotation processor through an app or system service. No user interaction is required once the attacker has device access. Limiting factors: AV:L constrains this to actors with physical or local software access to the device; S:U means the privilege escalation is bounded to the vulnerable system's own privilege boundary and does not directly break out to other systems. The 'supply chain risk' framing is not independently confirmed and may indicate the processor runs in build pipelines rather than runtime user space - if so, exploitation conditions may differ from a standard local app exploit.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, indicating local exploitation with low complexity, low-privilege requirements, and no user interaction needed. Real-world risk is meaningful given Android's ubiquity, but the AV:L constraint limits exposure to scenarios where the attacker already has local code execution (e.g., a malicious app or an insider). No KEV listing and no public exploit code has been identified at time of analysis. The 'supply chain risk' framing is an unusual qualifier in CVE descriptions and warrants independent verification - it may elevate the effective impact beyond a single device if the annotation processor runs in CI/CD or shared build environments. EPSS data is not available in the provided intelligence. The combination of no required user interaction and low-privilege local access makes this moderately automatable once device foothold is achieved.

An attacker installs a malicious application on an Android 16 or 17 device that crafts specially malformed comment-line input targeting the AnnotationProcessor's AppendCommentLine function. The malformed input passes validation checks and triggers privilege escalation, granting the attacker elevated system access without any user interaction beyond the initial app installation. No public exploit code has been identified at time of analysis, but the low complexity rating indicates exploitation would be straightforward once the trigger input is understood.