EUVD-2025-210009
GHSA-jmw3-jmqp-jvmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryApp runs with normal user privileges
-
ExploitInvoke vulnerable ComputerEngine.java URI resolution
-
ExecutionBypass cross-user access check
-
PersistRead URIs from other user/profile
-
ImpactExfiltrate sensitive cross-profile data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have a local app installed on the target device running with normal app-tier privileges (CVSS PR:L), and the device must run an unpatched Android 14, 15, 16, or 16-qpr2 build. The vulnerable cross-user URI access path in ComputerEngine.java must be reachable, implying the device is configured with more than one Android user or profile (e.g., work profile, secondary user, guest) holding the data the attacker wants to reach - on a single-user device with no work profile, the cross-user boundary the bug breaches is not meaningfully present. No user interaction is required (UI:N), and no additional execution privileges beyond a standard installed app are needed. Exploitation is limited to local context (AV:L) - it cannot be triggered remotely without first landing code on the device. |
| Impact | Signals are mixed but converge on moderate priority. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) reflects a high-impact local escalation, but EPSS at 0.12% (31st percentile) and SSVC indicating Exploitation: none, Automatable: no, Technical Impact: partial all suggest no widespread exploitation activity and a meaningful barrier to weaponization at scale. The vulnerability is not on CISA KEV, and no public exploit is identified at time of analysis. The 'Authentication Bypass / Privilege Escalation' tagging combined with PR:L (some local privileges required, i.e. an installed app) means a malicious or compromised app on-device is the realistic threat - not a remote attacker. Note the SSVC Technical Impact is 'partial' while CVSS rates C/I/A as High; this divergence suggests CISA views the cross-user URI access as scoped rather than full system compromise. Prioritize for managed-device fleets where untrusted apps may be installed; lower urgency for tightly controlled enterprise deployments. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from a third-party source (or a malicious app slips past Play Protect). The app, running as a low-privileged user, invokes the vulnerable ComputerEngine.java code paths to resolve and read content URIs belonging to a different Android user - for example, exfiltrating data from a work profile while running in the personal profile - without prompting the victim or requiring any interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 03, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged app to access URIs belonging to other users on the device due to a logic error across multiple functions in ComputerEngine.java. No user interaction or additional execution privileges are required, but exploitation is local and currently no public exploit is identified at time of analysis (EPSS 0.12%, SSVC exploitation: none).
Earlier versions of this analysis (2)
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged app to access URIs belonging to other users on the device due to a logic error in ComputerEngine.java. No user interaction or additional execution privileges are required, but exploitation is local-only and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's ComputerEngine.java allows any unprivileged local user to access URIs belonging to other user accounts due to a logic error in access control. Affected versions span Android 14, 15, 16, and 16-qpr2, covering a broad swath of active Android deployments. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; however, the CVSS vector confirms exploitation requires no privileges and no user interaction once local access is established.
RemediationAI
Apply the Android Security Bulletin patch level dated 2026-06-01 or later, available via the June 2026 Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-06-01; OEM-shipped patches will roll out on the device manufacturer's schedule, so enterprise fleets should verify the security patch level (Settings → About → Android security update) reflects 2026-06-01 or newer. No vendor-released patched build version is independently confirmed in the supplied data beyond the bulletin date reference. As a compensating control until patched OEM builds reach devices, restrict sideloading via MDM (disallow installation from unknown sources) and review managed Google Play allowlists to reduce the risk of a malicious local app being present; on multi-user/work-profile deployments, minimize the use of secondary users carrying sensitive data on unpatched devices, accepting the trade-off of reduced profile separation features.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in ComputerEngine.java, a component of the Android PackageManager service stack responsible for resolving and querying package and content URI information across the multi-user framework. Android isolates data between users (work profiles, secondary users, guest accounts) via UID/user-ID boundaries enforced through permission checks on URI grants. The CWE-284 (Improper Access Control) classification indicates that one or more code paths in this engine fail to correctly validate cross-user URI access, breaking the user-isolation boundary that Android's multi-user model depends on. Per CPE data, the affected product is Google Android across multiple major releases.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
7DescriptionCVE.org
In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 14-16 devices are vulnerable to local privilege escalation enabling any installed application to read and access data from other user accounts on the same device without requiring elevated permissions or user awareness. For organizations with multi-user Android deployments or bring-your-own-device programs, this creates a data leakage risk affecting confidentiality of user information. Immediate remediation requires either removing multi-user capability or restricting application ecosystem access pending vendor security updates.
No vendor-released patch identified at time of analysis. Disable multi-user device profiles via MDM to eliminate the attack surface. Enforce Android Enterprise Work Profile mode to isolate personal and work data contexts. Restrict app installation to approved applications via managed app store or MDM controls. Implement access logging and monitoring for anomalous inter-user data access patterns. Provide user education regarding untrusted apps. Consider restricting affected Android versions from handling sensitive corporate data pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB