EUVD-2026-79160
GHSA-4r76-fhfm-mm9g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local System-privileged execution on device
-
ExploitInvoke code path with flawed permission check
-
ExecutionBypass intended protection boundary (logic error)
-
ImpactEscalate privileges beyond System scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires the attacker to already possess local System execution privileges on an affected Android device (per the description, 'local escalation of privilege with System execution privileges needed'); it is not remotely reachable and needs no user interaction. This high pre-condition (PR:H) is the primary limiting factor: an attacker must first compromise a System-context process, so this functions as a privilege-boundary bypass chained after an initial foothold rather than an independent entry point. Scope is limited to devices covered by the Pixel/Android September 2026 security bulletin; the exact vulnerable component is undisclosed ('multiple locations'). |
| Impact | Signals are consistent and point to a genuinely low-priority, locally-scoped issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) describes a local privilege-escalation that itself requires the attacker to already hold System execution privileges - the description explicitly states 'System execution privileges needed.' This is an unusual EoP posture: the elevation delta above an already-System context is limited, which makes the C:H/I:H/A:H impact rating generous. EPSS is very low at 0.13% (3rd percentile), there is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict: low EPSS, high required privilege, and local-only vector all agree this is not a mass-exploitation candidate. The main caveat is that the description is Android's standard terse bulletin boilerplate ('multiple locations', 'logic error'), so the precise affected component and the true privilege boundary crossed are not disclosed and should be verified against the Pixel bulletin. |
| Exploit ScenarioDerived | A malicious app or process already running with System execution privileges on an affected Android/Pixel device abuses a permission-check logic error to bypass an intended protection boundary and escalate further, without any user interaction. No public exploit code exists, and exploitation requires the attacker to have already achieved a high-privilege foothold on the local device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
RemediationAI
Vendor patch is available per the Android Security Bulletin dated 2026-09-01 (Pixel) at https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01; no exact fix version or build identifier was included in the provided data, so apply the current September 2026 security patch level OTA for the device and verify the reported security patch level in Settings > About phone. Because the vulnerability requires pre-existing System execution privileges (PR:H) and is not remotely reachable, the effective compensating control is reducing the likelihood of an attacker reaching a System context to begin with: keep the device on the latest available patch level, avoid enabling developer options or USB debugging on production devices, and restrict sideloading and untrusted app installation, with the trade-off that these measures reduce functionality for development and testing workflows. Additionally, monitoring or hardening of privileged System-context services (for example restricting which apps can bind to or invoke system services) raises the bar for the prerequisite foothold, though it does not patch the underlying permission-bypass logic. No public exploit code was identified at time of analysis, so exploitation likelihood for unpatched but non-compromised devices remains low; devices that are already running with a compromised System-context component should be treated as potentially escalating and re-flashed or factory-reset after patching. There is no confirmed configuration setting documented to disable the affected code path, and no vendor workaround beyond patching was provided.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified under CWE-693 (Protection Mechanism Failure) and is described as a permission bypass arising from a logic error in code at multiple undisclosed locations - consistent with a flaw in an Android kernel access-control or permission-checking routine rather than a memory-safety bug. CPE data (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*) anchors the affected platform to Google Android broadly, while the ENISA EUVD entry (EUVD-2026-79160) narrows the affected component to the Android kernel. The CVSS vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H shows local attack vector, low attack complexity, high privileges required, no user interaction, and unchanged scope with high confidentiality, integrity, and availability impact. Because PR:H applies, exploitation does not grant an initial foothold: the attacker must already run code in a System-privileged context, so the practical risk is escalation across a privilege boundary (for example, from a System-context process to a more privileged or protected kernel-mediated operation). The precise vulnerable function and the exact set of affected kernel builds are not disclosed in the available data, which is typical for Android security bulletin entries issued under coordinated disclosure.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only vector with no UI; PR:H because the description states System execution privileges are required as a precondition; full C/I/A retained per vendor though the real elevation delta above System is modest.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB