Monthly
Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.
Sandbox escape via confused deputy in Chrome's DataTransfer component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by directing the victim to a crafted HTML page. Fixed in Chrome 153.0.8010.36, this is classified 'Medium' severity by the Chromium team despite the CVSS 8.3 score with full scope change (S:C, C:H/I:H/A:H), reflecting that renderer pre-compromise is required. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS is 0.25% (16th percentile).
Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.
Privilege escalation in Android's PickActivity allows any installed low-privileged application to silently bypass the 'Install unknown apps' security restriction, enabling unauthorized APK installation without user consent across Android 14, 15, 16, and 16-QPR2. The root cause is a confused deputy flaw (CWE-441) in the setupLayout method of PickActivity.java, where the privileged activity can be manipulated into performing installation actions on behalf of a less-privileged caller, circumventing a core Android security boundary. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H scoring across all current Android releases.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.
Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.
Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.
Sandbox escape via confused deputy in Chrome's DataTransfer component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by directing the victim to a crafted HTML page. Fixed in Chrome 153.0.8010.36, this is classified 'Medium' severity by the Chromium team despite the CVSS 8.3 score with full scope change (S:C, C:H/I:H/A:H), reflecting that renderer pre-compromise is required. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS is 0.25% (16th percentile).
Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.
Privilege escalation in Android's PickActivity allows any installed low-privileged application to silently bypass the 'Install unknown apps' security restriction, enabling unauthorized APK installation without user consent across Android 14, 15, 16, and 16-QPR2. The root cause is a confused deputy flaw (CWE-441) in the setupLayout method of PickActivity.java, where the privileged activity can be manipulated into performing installation actions on behalf of a less-privileged caller, circumventing a core Android security boundary. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H scoring across all current Android releases.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.
Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.