EUVD-2026-115611
GHSA-hx7p-mvhj-vcfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or compromise an on-device app
-
ExploitInvoke WindowState relayout code path
-
ExecutionTrigger logic error bypassing permission check
-
ImpactGain elevated local privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires the attacker to already be running unprivileged code on the target device (local attack vector), typically via an installed application; the flaw is a logic error in prepareWindowToDisplayDuringRelayout (WindowState.java) that bypasses a permission check during window relayout. Per the CVSS vector no additional Android permissions (PR:N) and no user interaction (UI:N) are required once code is executing locally. Limiting factors: the attacker needs an on-device foothold (cannot be triggered remotely), and exploitation is confined to affected OS builds - Android 14, 15, 16, 16-qpr2, and 17. SSVC marks Automatable: no, indicating it is not trivially scalable across targets. |
| Impact | This is a locally-exploitable Android privilege-escalation flaw (CWE-693, protection mechanism failure) carrying a HIGH CVSS 8.4. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates a low-complexity local attack requiring no privileges and no user interaction, with total confidentiality, integrity and availability impact - consistent with the SSVC 'Technical Impact: total' rating. However, AV:L means the attacker must already be executing code on the device (e.g. via an installed app), so PR:N here means 'no granted Android permissions needed' rather than 'remotely reachable without a foothold.' The signals are internally consistent but point to a contained-blast-radius local issue, not a wormable remote one: SSVC 'Exploitation: none' and 'Automatable: no' align with the vuln.today priority of 'this_week' rather than act_now/emergency. The flaw is NOT in CISA KEV and there is no public exploit reference, so there is no confirmed active exploitation. EPSS is not provided in the input, so exploitation probability cannot be quantified. Net: a genuine high-severity local EoP worth patching on the normal monthly Android cadence, but not an emergency given no exploitation evidence and the requirement for an on-device foothold. |
| Exploit ScenarioDerived | A malicious or compromised app already installed on an Android device (Android 14 through 17) invokes the window-relayout code path in WindowState.java, where a logic error in prepareWindowToDisplayDuringRelayout causes a permission check to be bypassed. With no user interaction and no special permissions, the app escalates to privileges it should not hold. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 lets code already running on the device bypass a permission check in WindowState.java's prepareWindowToDisplayDuringRelayout and obtain high-integrity code execution, with no additional Android permissions (PR:N) and no user interaction (UI:N) required. The defect is a CWE-693 protection-mechanism failure in the window relayout path, scored CVSS 8.4 with total technical impact per SSVC. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and SSVC records the flaw as not automatable.
RemediationAI
Update to the build carrying the fix published in the Android Security Bulletin dated 2026-11-01 (https://source.android.com/docs/security/bulletin/2026/2026-11-01), which covers Android 14, Android 15, Android 16, Android 16-qpr2 and Android 17; the supplied data does not include individual build IDs or patch levels, so consult the bulletin for the exact patch level per branch and confirm the device's build date matches or exceeds it. No workaround or compensating control is documented in the available sources, and updating is the only complete remediation identified. Because the vector is local (AV:L) and requires code already executing on the device, exposure tracks whatever already limits untrusted code reaching the device, but that does not replace installing the fixed build.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WindowState.java is part of the Android framework's WindowManagerService, which tracks per-window state inside system_server and drives relayout/display-preparation steps; prepareWindowToDisplayDuringRelayout is one of those display-preparation routines. The flaw is a logic error that causes a permission check to be skipped or misapplied during that relayout step, which is why it is classified as CWE-693 (protection mechanism failure) rather than a memory-safety bug. The CVSS vector AV:L/AC:L/PR:N/UI:N means the attacker needs an existing unprivileged code-execution foothold on the device but no extra Android permission grant and no victim interaction thereafter; the exact sequence of window operations that reaches the flawed branch is not described in the available sources. Affected builds enumerated by ENISA EUVD are Android 14, 15, 16, 16-qpr2 and 17, matching CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*; SSVC lists Exploitation: none, Automatable: no, Technical Impact: total.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app with no granted permissions (AV:L, PR:N) triggers a straightforward logic-error permission bypass (AC:L) yielding total local impact (C:H/I:H/A:H) within one component (S:U).
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 2
Executive ViewAI
A high-severity local privilege escalation vulnerability in Google Android versions 14 through 17 allows code already running on a device to bypass permission checks and achieve elevated code execution. This impacts the integrity of the Android platform, potentially enabling malicious apps or limited code to gain unauthorized capabilities, which could lead to data compromise or further system exploitation. Security leadership should prioritize patching as soon as a vendor fix is available and enforce interim mitigations to reduce risk.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing app installation only from trusted sources, disabling sideloading via MDM policies, regularly reviewing app permissions, and monitoring for anomalous behavior on Android devices. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB