EUVD-2026-78962
GHSA-xm68-37r6-qfqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged local app
-
DeliveryInvoke vulnerable kernel path
-
ExploitRace improper locking to free object
-
ExecutionReclaim freed allocation (UAF)
-
PersistCorrupt kernel memory for r/w
-
ImpactEscalate to kernel/root privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have local code execution on the device as an unprivileged app (AV:L, PR:N means no elevated privileges, but on-device presence is required). No user interaction is needed (UI:N). Exploitation depends on winning a race in the improperly-locked kernel path to trigger the use-after-free, which introduces timing/reliability constraints in practice. Limiting factors: no remote/network reachability, exploitation is confined to Android/Pixel kernel builds shipped before the 2026-09-01 patch level, and success requires reliable kernel heap grooming - device- and version-specific. |
| Impact | This is a genuine but not urgent local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.4) describes a use-after-free (CWE-416) caused by improper locking that an unprivileged local app can trigger with no user interaction - a plausible kernel EoP given the EUVD affected-component 'Android kernel'. The C:H/I:H/A:H triad is generous boilerplate typical of Android bulletin entries, but for a kernel-space UAF full-impact compromise is more defensible than for the userspace/HAL siblings. Real-world exploitation signals are LOW and consistent with each other: EPSS is 0.11% (2nd percentile), there is no CISA KEV listing, and no public POC. No SSVC decision data was provided. Bottom line: the high base score reflects the theoretical impact of a kernel memory-corruption EoP, not active threat - this is a patch-in-normal-cycle item, prioritized higher only on Pixel/Android fleets where local untrusted apps are the threat model. The AV:L vector and description (local app, no remote reachability) are internally consistent; no conflicting signals were found. |
| Exploit ScenarioDerived | A malicious or compromised unprivileged app installed on an Android/Pixel device issues carefully timed calls into a kernel path where locking is improper, racing to reuse a freed object and corrupt kernel memory. By grooming the freed allocation the app converts the use-after-free into arbitrary kernel read/write and escalates to root/system privileges, all without user interaction. No public exploit code is currently identified, and the local attack vector means no remote path exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Local privilege escalation in the Android kernel affecting Google/Pixel devices lets an unprivileged app already running on the device trigger a use-after-free and gain elevated privileges. The flaw stems from improper locking in a kernel code path (CWE-416), and no user interaction is required; however, an attacker must first have local code execution on the device and must win a locking race to corrupt kernel memory, which adds real-world reliability constraints. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.11% (2nd percentile), so this is a genuine but not urgent local privilege-escalation issue confined to devices running kernel builds older than the 2026-09-01 patch level.
Earlier versions of this analysis (1)
Local privilege escalation in the Android kernel via a use-after-free (CWE-416) caused by improper locking in a kernel code path, tracked as CVE-2026-56914. A process already running with low (unprivileged) app-level permissions - PR:L, AV:L per the assessed CVSS vector - can race the vulnerable path to corrupt freed memory and escalate to kernel-level code execution, with no user interaction required (UI:N). Exploitation is timing-dependent because it hinges on winning a kernel race window, and no public exploit code has been identified at time of analysis; EPSS is 0.11% (2nd percentile), reflecting the local-only vector and the need for pre-existing code execution. Devices patched to the 2026-09-01 Android/Pixel security level are not affected.
RemediationAI
Fix by updating affected Google/Pixel devices to the Android/Pixel security patch level of 2026-09-01 or later, as documented in the vendor bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01; there is no application-layer workaround because the defect is in the kernel itself, so an OTA firmware update is the only complete remedy. Until the update is applied, compensating controls should focus on denying the prerequisite local foothold: keep the app ecosystem tightly restricted (no sideloading of untrusted APKs, no installation from unknown sources), keep Google Play Protect enabled, and enforce app sandboxing and least-privilege via managed configuration (Android Enterprise/work profiles) so that a malicious app cannot easily achieve the initial local execution the exploit requires. Organizations should also avoid granting unnecessary permissions and uninstall unused apps to shrink the attack surface, and monitor for abnormal privilege-escalation or root-like behavior on unpatched devices. Note the trade-offs: these controls reduce the chance of an attacker obtaining local code execution but do not eliminate the underlying kernel bug, and because exploitation of the use-after-free is race-dependent, an attacker with sufficient time and a stable device target may still succeed - so patching should be treated as the priority, not deferred in favor of workarounds.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a use-after-free (CWE-416) arising from improper locking in multiple locations within the Android kernel, as reported by Google Devices. Improper synchronization allows a kernel object to be freed while another execution context still holds a reference to it, after which the dangling pointer can be reused - typically leading to kernel memory corruption that an attacker can shape into privilege escalation. Because the root cause spans multiple code locations, the affected surface is the kernel locking/unlocking discipline around the object lifecycle rather than a single function. Per the CPE data (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*) and the ENISA EUVD record, the affected component is the Android kernel as shipped on Google/Pixel builds prior to the 2026-09-01 patch level. Exploitation is gated by the assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: it is local-only (AV:L) with no elevated privileges required (PR:N) and no user interaction (UI:N), but it is not remotely reachable, and reliability depends on winning a race and performing device- and version-specific kernel heap grooming. Immediate impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H) once the use-after-free is successfully converted into kernel code execution, breaking the Android application sandbox and privilege boundary.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local unprivileged app triggers a kernel UAF with no interaction; kernel-space compromise supports C/I/A:H, though a race arguably justifies AC:H.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A high-severity local privilege escalation flaw in the Android kernel used by Google Pixel devices could allow a malicious app already present on a phone to break out of its sandbox and gain elevated system privileges. The risk is concentrated in mobile endpoints running kernel builds older than the 2026-09-01 patch level, particularly those issued to executives, administrators, and staff handling sensitive data; a successful attack could expose corporate email, credentials, and any data accessible from the device. Because exploitation requires an attacker to already have code running on the device and to win a timing race, leadership should treat this as a manageable but real endpoint risk rather than an immediate crisis.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing managed app allowlisting and disabling sideloading via MDM, relying on Google Play Protect and mobile threat defense to block untrusted applications, limiting the number of untrusted apps installed on affected devices, and monitoring for anomalous privilege or kernel activity; these are partial mitigations only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB