Google Android CVE-2026-59020

Exploitation requires local code execution on the device with User execution privileges - i.e., an app or process already running at ordinary application privilege level; it cannot be triggered remotely and needs no user interaction (UI:N). The specific trigger is a race condition (CWE-362) in the removeUserData routine of DevicePolicyManagerService.java; the exact timing window and how it is driven are not described in the available sources. Practical exploitation is limited by high attack complexity (the attacker must reliably win the race) and by the local-privilege prerequisite, and impact is confined to denial of service (no data disclosure or modification). Affected deployments are Android 14, 15, 16, 16-qpr2, and 17.

This is a moderate-severity, low-priority local availability issue, not an urgent remote threat. The CVSS 3.1 base score of 5.9 is driven entirely by availability impact (A:H) with no confidentiality or integrity impact, a local attack vector (AV:L), and high attack complexity (AC:H) reflecting the race condition (CWE-362). Multiple signals agree it is low real-world priority: EPSS is just 0.11% (1st percentile), there is no CISA KEV listing, and no public exploit was identified in the supplied data. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cycle item rather than act_now/emergency. Note a conflict in the input: the CVSS vector states PR:N (no privileges), but the description explicitly says 'User execution privileges needed' - meaning a local app/process running with ordinary app privileges is required. These signals disagree, so the vector's PR:N appears too generous; treat this as requiring a local foothold (an installed/running app), which further lowers practical risk. The high attack complexity (winning a race) and local-only vector make opportunistic or mass exploitation impractical.

A malicious or compromised app already installed on the device, running with ordinary user/app execution privileges, repeatedly invokes the affected user-data removal path to win a timing race in DevicePolicyManagerService. Successfully hitting the race triggers a denial-of-service condition on the device. No public exploit code was identified, and the high complexity means the attacker must reliably win a race window, making exploitation unreliable.