EUVD-2026-78952
GHSA-pvg8-xvmx-xhrq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local app-level foothold gives AV:L/PR:L; permission bypass needs no interaction (UI:N/AC:L) and yields full privilege escalation, so C:H/I:H/A:H.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
4DescriptionCVE.org
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local privilege escalation in Google Android/Pixel devices allows an already-running non-privileged app to bypass permission checks and gain elevated privileges through a logic error in the code. Exploitation requires the attacker to have existing local code execution at User level on an unpatched device, with no user interaction needed once the malicious or compromised app is running. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already have local code execution at User (non-privileged app) level on an affected Google Android/Pixel device - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) is internally consistent with the description: a logic error causing a permission bypass that yields local privilege escalation requiring only existing User-level execution privileges and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix from the 2026-09-01 Android/Pixel security bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01; this is a vendor-released patch per the referenced advisory, though an exact Android build or kernel version is not specified in the input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Google Android/Pixel devices, verify current security patch level, and enforce policies that block sideloading/unknown sources and untrusted app installs; enable mobile threat defense monitoring for permission-bypass or privilege-escalation behavior. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today