Google Android CVE-2026-56952

Exploitation requires the attacker to already possess local System execution privileges on the Android device and to reach the platform_msg_handler_init code path in default_msg_handlers.c, where a required permission check is missing (CWE-862). No user interaction is needed (UI:N). The key limiting factors are: (1) local access only - there is no network/remote vector (AV:L); and (2) a high pre-existing privilege level (PR:H, 'System execution privileges needed'), meaning this cannot be launched from an unprivileged app or remotely. It is an authorization-boundary bypass available to an already-privileged local actor, not a path to initial device compromise.

This is a moderate-priority local privilege escalation (CVSS 6.7, CVSS:3.1/AV:L/AC:L/PR:H/UI:N) in Android's platform_msg_handler_init (default_msg_handlers.c), classified as CWE-862 (Missing Authorization). The signals are internally consistent and point to a bounded threat: AV:L means the attacker must already have local code execution on the device, and PR:H combined with the description's note that 'System execution privileges needed' means a fairly privileged (System-level) starting position is required - this is not a remote or zero-click flaw. The 'total' technical impact in SSVC aligns with C:H/I:H/A:H. However, SSVC Exploitation is 'none' and there is no CISA KEV listing and no public POC, so this is best read as a high-impact-but-high-barrier issue rather than an actively-exploited emergency. No EPSS score was provided in the input, so exploitation-probability cannot be factored in - this is a data gap. The requirement for pre-existing System privileges materially lowers real-world risk: an attacker already at System has substantial control, so the marginal gain is primarily full privilege escalation / sandbox or permission-boundary bypass rather than initial compromise.

A malicious or compromised process already running with System execution privileges on an Android device invokes the message-handler initialization path, which fails to enforce a required permission check. By exercising this path, the process bypasses the authorization boundary and escalates to full privilege without any user interaction. No public exploit code is identified at time of analysis, so this would currently require custom tooling.