Google Android CVE-2026-59015

Exploitation requires local access to the device - in practice, attacker-controlled code already running on the handset (e.g. a malicious installed app), as indicated by AV:L. No user interaction and no additional execution privileges are required (UI:N, PR:N), and the scope is unchanged (S:U). The confused-deputy condition means the attacker's component leverages a more-privileged Android component to obtain data; the exact affected component and configuration are not described in the available sources ('multiple locations'). Limiting factors: the bug is not remotely reachable, impact is confined to limited confidentiality disclosure (C:L) with no integrity or availability effect, and it affects only Android 15, 16, 16-qpr2, and 17 - devices patched via the 2026-11-01 Android security update are not exposed.

This is a moderate-severity local information-disclosure issue (CVSS 4.0) in Android, not a widespread-exploitation priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates the flaw requires local access - it cannot be reached across the network - and yields only limited confidentiality impact with no integrity or availability effect. The mechanism is a confused-deputy permission bypass (CWE-441), meaning a lower-privileged local component induces a more-privileged component to leak data on its behalf; PR:N in the vector reflects that no additional execution privileges are needed, consistent with the description ('no additional execution privileges needed'). Supporting signals reinforce the low-urgency reading: EPSS is 0.12% (2nd percentile), the CVE is NOT in CISA KEV, and no public exploit or PoC reference is present in the input. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not act_now/emergency. The signals are internally consistent: a genuine but bounded local-disclosure bug best handled through normal monthly Android patch adoption rather than emergency response.

A malicious or compromised app already present on the device abuses a confused-deputy flaw to coax a higher-privileged Android component into disclosing data the app could not otherwise read, resulting in local information disclosure without user interaction. Because the vector is local (AV:L), the attacker must first achieve code execution on the device, typically via an installed app. No public exploit code or PoC reference is identified in the available sources.