Google Android CVE-2026-58854

Exploitation requires the attacker to already have local, low-privilege code execution on the device - for example, a malicious or compromised app running in its own sandbox (PR:L, AV:L) - and no user interaction (UI:N). There are no special configuration prerequisites noted; the flaw is reachable in default Android builds within the affected versions (Android 14 through 17, including 16-qpr2). The key limiting factor is the need for an existing on-device foothold rather than remote reachability, which caps real-world risk to scenarios where an attacker can first get code onto the device (malicious app install, prior RCE, or physical/local access).

This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity attack that requires the attacker to already hold low-level privileges (e.g., an installed/running app or local code execution context) with no user interaction, yielding total impact (C:H/I:H/A:H) via type-confusion memory corruption - consistent with the SSVC 'Technical Impact: total' rating. However, the exploitation signals argue against treating this as a drop-everything issue: SSVC 'Exploitation: none' and 'Automatable: no' align with no CISA KEV listing and no public POC identified, so this is currently a patch-on-cycle privilege-escalation bug rather than one under active mass exploitation. EPSS is not provided in the input, so the quantitative exploitation probability cannot be stated. The signals are internally consistent (local vector matches 'local escalation of privilege' in the description; PR:L matches the need for a foothold), with no contradictions to flag. The practical risk is that such Android EoP bugs are frequently chained behind a separate remote/initial-access vulnerability or a malicious app to achieve full device compromise, so it is material for high-value or at-risk fleets.

A malicious or compromised application already running on an Android device triggers the type-confusion condition in the affected component to corrupt memory and escalate from its sandboxed low-privilege context to a higher-privileged one, requiring no user interaction. No public exploit code has been identified at the time of analysis, and the SSVC framework rates it as not automatable, implying a non-trivial, likely bespoke exploit. Given AC:L, once a working primitive is developed, reliable exploitation is plausible.