Google Android CVE-2026-59028

Requires a locally installed, unprivileged Android application; the flaw lies in NFC AID (Application Identifier) conflict resolution within RegisteredAidCache.resolveAidConflictLocked, so exploitation involves manipulating AID registration/routing to turn a more-privileged system component into a confused deputy. Per the CVSS vector it is local (AV:L) with low complexity (AC:L) and needs no privileges (PR:N) and no user interaction (UI:N), so no victim action is required once the malicious app runs. The principal limiting factor is the local attack vector: an attacker must first get code running on the device (e.g., via an installed app), as there is no network-facing exposure. Affected builds are Android 15, 16, 16-qpr2, and 17; devices patched at the November 2026 security patch level are not affected.

Signals are mostly aligned toward a serious-but-not-urgent local flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 8.4) describes a locally exploitable privilege escalation requiring no user interaction and no pre-existing privileges, which matches the description's 'local escalation of privilege with no additional execution privileges needed.' The SSVC framework reinforces this: Technical Impact is 'total' (consistent with C:H/I:H/A:H), but Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no' (the attacker must already have local code execution via an installed app, so it does not chain into worm-like mass exploitation). There is no CISA KEV listing, no EPSS value supplied, and no PoC or exploit reference in the input. The vuln.today priority of 'this_week' and Google's own rating are consistent with a high-impact local EoP that is not under active exploitation - a genuine priority for patch cycles but not an emergency. No signals conflict; the main gap is the absence of an EPSS score, so probabilistic exploitation likelihood cannot be compared here.

A user installs a malicious or trojanized Android app that requests no sensitive permissions. Because the flaw is a confused-deputy error in how RegisteredAidCache.resolveAidConflictLocked handles NFC AID routing conflicts, the app abuses a more-privileged system component to perform actions it should not be allowed to, escalating its own privileges locally with no user interaction. No public exploit or PoC is identified in the provided data; exploitation requires local code execution via the installed app (AV:L).