Google Android CVE-2026-55286

Exploitation requires the attacker to already have local code execution on the device - i.e., a malicious or compromised application running with ordinary low app privileges - that can reach the stpropnci_process function in stpropnci.cc and supply input triggering the incorrect bounds check. Per the Android advisory language, no additional execution privileges and no user interaction are needed once such code is running. The primary limiting factor is the local attack vector (AV:L): there is no network-facing or remote trigger, so the flaw cannot be exploited without first gaining a foothold on the device, which typically means social-engineering the user into installing a hostile app or chaining it behind a separate remote bug. Affected scope is confirmed as Android 17.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: a local, low-complexity out-of-bounds write (CWE-119) reachable by already-present low-privilege code with no user interaction, yielding full local escalation of privilege. The AV:L (local) metric is the key governor - this is NOT remotely exploitable, so it requires an attacker to already be running code on the device (typically a malicious or compromised app). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The signals are therefore not conflicting but sparse: a credible high-impact local privilege-escalation bug patched in a monthly Android bulletin, consistent with a typical chained exploitation step (app sandbox escape → kernel/system compromise) rather than a standalone widespread-exploitation event. Absence of KEV/POC/EPSS is an absence of evidence, not confirmation of low risk - Android bulletin EoP bugs are historically valued in exploit chains.

A user installs a malicious or trojanized app that runs with normal, low app privileges. The app invokes the vulnerable stpropnci_process code path with crafted input that triggers the out-of-bounds write due to the incorrect bounds check, corrupting memory to escalate from the app sandbox to higher system/privileged context. No user interaction and no additional execution privileges are required; no public POC was identified in the provided data.