Google Android CVE-2026-55359

Requires the attacker to already have local code execution at User (non-privileged app) level on an affected Google Android/Pixel device - i.e. a malicious or compromised app running on the device. No user interaction is needed once the app runs (UI:N), and no elevated privileges are required beyond normal app execution (PR:L). Limiting factors: the attacker must first get code onto the device (no remote/network vector, AV:L), and the device must be an unpatched version predating the 2026-09-01 Android/Pixel security bulletin fix. The generic description ('multiple locations', logic error in a permission check) means the precise triggering feature or configuration is not specified in the available data.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) is internally consistent with the description: a logic error causing a permission bypass that yields local privilege escalation requiring only existing User-level execution privileges and no user interaction. This is a genuine local privilege-escalation class issue, but the exploitation signals point to LOW real-world urgency: EPSS is only 0.13% (3rd percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. The high base score is driven entirely by the C:H/I:H/A:H impact of a full permission bypass, not by ease of remote reach - the AV:L attack vector means an attacker must already be able to run code on the device (e.g. a malicious or compromised app). SSVC-style reading: exploitation status is 'none/POC-absent', automatable is unlikely given the local vector and need for an on-device foothold, and technical impact is 'total' for the escalated process. Net: a real patch-worthy local EoP, but not an emergency - priority should follow normal Android/Pixel monthly-bulletin patch cadence rather than out-of-band response. Note the description is generic ('multiple locations', 'logic error') so the exact affected component is not pinned down in the provided data.

A user installs or is tricked into running a low-privileged malicious application on an affected Android/Pixel device. The app exploits the permission-bypass logic error to gain elevated privileges without any user interaction or additional prompts, escalating from an untrusted app context toward system/privileged access. No public exploit code was identified at time of analysis, so this would require attacker-developed tooling.