Google Android CVE-2026-59016

Exploitation requires local access to an affected Android 17 device - in practice, the attacker must already be able to execute code locally, typically via a malicious or compromised application invoking the sendAnomalyProfile routine of ProfilingService. No additional execution privileges and no user interaction are required once local code execution is achieved (PR:N/UI:N). Limiting factors: the attack vector is local only (AV:L), so it cannot be triggered remotely over a network; exploitation is confined to devices running the affected Android 17 release; and it presupposes the attacker can get code running on the device in the first place (e.g., a user-installed malicious app). The specific configuration or input that triggers the traversal is not detailed beyond the vulnerable sendAnomalyProfile code path.

Signals are consistent and point to a genuine but locally-scoped privilege-escalation risk rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 8.4) indicates that exploitation requires local access to the device but, once there, needs no privileges or user interaction and yields high confidentiality, integrity and availability impact - classic Android local escalation-of-privilege shape where the 'local' vector is typically a malicious app already running on the device. The EPSS score is very low (0.11%, 1st percentile), the CVE is NOT on CISA KEV, and no public exploit or PoC reference is provided, so there is no evidence of active or imminent widespread exploitation. The vuln.today decision label is 'this_week', indicating it should be remediated promptly but is not flagged act_now/emergency. The low EPSS combined with AV:L is coherent: local-only vulnerabilities rarely score high EPSS because they cannot be sprayed remotely. Net: a legitimately high-severity flaw worth patching in the normal Android monthly cadence, not a fire-drill; the main caveat is that CVSS high-impact ratings for Android local EoP are vendor-assigned severity, and the exact mechanism by which the path traversal yields privilege escalation is not described in the available sources.

A user installs or runs a malicious or compromised app on an Android 17 device; that app invokes the sendAnomalyProfile path of ProfilingService with a crafted path containing traversal sequences. The service follows the attacker-controlled path outside its intended directory, allowing the app to read or write privileged files and escalate to higher privileges without any further user interaction. No public exploit or PoC reference is provided in the available data.