Google Android CVE-2026-56986

Requires local execution on the affected Android/Pixel device - an attacker-controlled unprivileged app running on a vulnerable build; there is no remote or network path (AV:L). No user interaction is needed once the malicious app runs (UI:N), and no elevated privileges are required to reach the vulnerable code (PR:N), but the attacker must first get code onto the device (e.g. sideloaded malicious app or a compromised existing app). Limiting factors: exploitation is confined to devices running the specific unpatched components addressed in the 2026-09-01 Pixel bulletin, and the reliability of turning an out-of-bounds read/type confusion into full privilege escalation depends on the affected component's memory layout.

This is a local escalation-of-privilege flaw in Android (Pixel/Tensor components per the 2026-09-01 Pixel bulletin) driven by an out-of-bounds read stemming from type confusion (CWE-441, confused deputy). The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.4, but the real-world signals argue for a lower operational priority: exploitation is local-only (AV:L) and requires an attacker to already have code execution on the device (typically a malicious or compromised app). EPSS is very low at 0.11% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' The C:H/I:H/A:H triad is characteristic Android-bulletin boilerplate and is generous for a primitive whose root cause is an out-of-bounds READ; a pure OOB read most directly supports information disclosure (C), while the integrity/availability claims and the 'privilege escalation' framing likely reflect the broader exploit potential of type confusion rather than the read alone. PR:N is credible here (a normal unprivileged app needs no special privileges to reach the vulnerable code), which is the notable severity driver. Net: a legitimate patch-worthy local EoP, but a routine-priority monthly-bulletin item, not an urgent internet-facing threat.

A user installs a malicious or trojanized app from outside the Play Store (or an attacker leverages an already-compromised low-privilege app). The app invokes the vulnerable Android component and triggers the type-confusion out-of-bounds read to leak memory and corrupt state, escalating from unprivileged-app context toward a more privileged component with no user interaction. No public proof-of-concept was identified in the provided data.