EUVD-2026-74028
GHSA-x96c-jjf5-c38j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local execution with minimal app privileges is sufficient (AV:L/PR:L); no scope change as impact is contained to the vulnerable device; full CIA impact reflects framework-level privilege escalation.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
4DescriptionCVE.org
In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Privilege escalation in Android's SmsController affects versions 14, 15, 16, and 16-QPR2 due to missing permission checks across multiple functions. A locally-running application with basic privileges can invoke these unguarded entry points to gain full read, write, and availability impact on the device without any user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that attacker-controlled code already execute locally on the target Android device with at least low-privilege app context - for example, via a sideloaded or store-delivered malicious application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat profile: local access with minimal privileges is sufficient, attack complexity is low, and no user interaction is needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Google's September 2026 Android Security Patch Level (2026-09-01) or later, delivered via OEM over-the-air system updates on supported devices. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory Android devices running versions 14, 15, 16, and 16-QPR2 in your environment and verify current patch status through your mobile device management platform. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today