Motorola Setup App CVE-2026-93832

Exploitation requires a separate attacker-controlled application already installed and running on the same Motorola device, because the flaw is an Android component of the Setup App exported without a guarding permission (CWE-862). No authentication beyond that local, low-privilege app context is needed and no user interaction is required (PR:L/UI:N), but the attack cannot be performed remotely or against a default device without first getting a malicious app onto it. Exploitation is limited to Motorola devices running Setup App versions prior to the 2026-01-01 fixed release; patched devices and non-Motorola Android devices are not affected. Impact is bounded to revoking runtime permissions from other apps (integrity/availability of those apps' granted permissions), with no data disclosure.

This is a genuinely low-to-medium real-world risk, and the available signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-privilege attack with no user interaction, and the modest 4.8 score reflects limited integrity impact (VI:L/SI:L/SA:L) with zero confidentiality or availability impact (VC:N/VA:N). CISA's SSVC framework reinforces this: Exploitation=none (no observed activity), Automatable=no, and Technical Impact=partial - none of which elevate urgency. No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The practical barrier is meaningful: an attacker must already have a malicious application running on the Motorola device to reach the exported component. This is a defense-in-depth hardening fix, not a priority emergency; patch it on a normal mobile-fleet update cadence rather than as an out-of-band response. Note the vendor advisory was not independently retrieved, so the exact fixed version is asserted from EUVD metadata rather than confirmed from the Motorola page text.

A user installs a malicious or trojanized app on a Motorola phone; because a Setup App component is exported without a protecting permission, that app can invoke it with no special privileges and no user prompt. The malicious app then revokes runtime permissions (e.g., location, camera, storage) from other installed apps, degrading or disabling their functionality. No public exploit code is identified at time of analysis, and the attack is confined to the local device.