Google Android CVE-2026-55287

Requires local presence on the device: the attacker must be able to run code as an installed application and reach GrantCredentialsPermissionActivity, the AOSP component that brokers one app's access to another app's stored account credentials. Exploitation depends on the misleading or insufficient UI of that grant dialog to obtain the credential grant; the precise trigger is not described in the available sources. Limiting factors: the vector is local (AV:L), not remote or network-reachable, so an attacker needs app-level foothold on the device first; SSVC marks it not automatable. The description's claim that user interaction is not needed conflicts with the CVSS UI:N vs. the 'trick the user' mechanism, so whether a victim tap on the grant dialog is actually required is unverified and should be confirmed against the Android bulletin.

This is a local privilege-escalation flaw (CVSS:3.1 AV:L/AC:L/PR:N/UI:N, base 8.4) in Android's GrantCredentialsPermissionActivity, rated CWE-451 (UI misrepresentation). The signals are mixed and should temper urgency. On severity: the vendor assigns total technical impact (C:H/I:H/A:H), consistent with an unprivileged local app obtaining account credentials. On likelihood: SSVC reports Exploitation=none and Automatable=no, no CISA KEV entry is present, no EPSS score was supplied, and no public exploit or PoC reference appears in the input - so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', i.e. prioritized but not an emergency, which aligns with a high-impact-but-not-yet-exploited local bug. One internal conflict must be flagged for verification: the CVSS vector states UI:N (no user interaction) while the description says the attack works by tricking 'the user into granting account credentials due to misleading or insufficient UI' - a social-engineering mechanism that normally implies user interaction. These two statements cannot both be literally true; verify the intended user-interaction requirement with the Android bulletin, because it materially changes the realistic difficulty. Net: a genuine local EoP worth patching on the normal monthly cadence, not a drop-everything issue absent any exploitation evidence.

A user installs a malicious or low-privilege app from an untrusted source. The app induces Android to present the credential-grant dialog in a misleading way so the victim (or the system flow) grants it access to another app's account credentials, yielding escalation on the device. No public exploit or PoC was identified in the available data, and the exact trigger is not described in the sources beyond 'misleading or insufficient UI'.