EUVD-2025-210013
GHSA-2mvq-m5m5-v7m7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app to device
-
DeliveryUser installs untrusted APK
-
ExploitApp triggers integer overflow in vulnerable component
-
ExecutionMemory corruption in privileged process
-
PersistEscalate from app sandbox to system privileges
-
ImpactAccess cross-app data and persist
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on an Android 14, 15, 16, or 16-qpr2 device - most realistically via a malicious application already running on the device (AV:L per CVSS). No user interaction is required once the malicious code runs (UI:N), and no prior privileges beyond an ordinary app sandbox are needed (PR:N), but the attacker must first achieve that local foothold, typically by convincing the user to install an untrusted APK or by compromising an existing app. Devices on patch levels prior to the June 2026 Android Security Bulletin are in scope; patched devices and configurations that block sideloading materially limit the realistic delivery path. |
| Impact | Signals are mixed but lean toward real but bounded risk. CVSS 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates local attack vector with low complexity, no privileges, and no user interaction required, plus full CIA impact - a strong combination once code is running on the device. However, SSVC reports Exploitation: none and Automatable: no, and no KEV listing or public POC has been identified, suggesting this is not currently being exploited at scale. EPSS data was not provided in the input. The local-only vector means an attacker must already have code execution on the device (e.g., via a malicious app), so the primary realistic delivery is a hostile or compromised application on Google Play or sideloaded - meaningful for high-value targets but lower urgency than a remote-network bug. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app from a third-party store or a compromised supply chain. The app triggers the integer overflow in a vulnerable Android component without requiring any user interaction beyond launch, corrupts memory in a privileged process, and escalates from app-sandbox UID to a higher-privilege context - gaining access to other apps' data, system settings, or persistence mechanisms. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) stems from an integer overflow (CWE-190) that can be triggered without user interaction to achieve code execution. With CVSS 8.4 and SSVC technical impact rated 'total,' a local attacker on the device can elevate privileges across security boundaries without additional execution rights. No public exploit identified at time of analysis and SSVC reports exploitation status as 'none.'
RemediationAI
Apply the Android Security Bulletin updates referenced at https://source.android.com/docs/security/bulletin/2026/2026-06-01; devices should be updated to a security patch level of 2026-06-01 or later as published by Google and downstream OEMs. Exact fix versions were not enumerated in the provided data - patch available per vendor advisory. Until OEM/carrier updates are delivered, compensating controls include restricting app installs to Google Play with Play Protect enabled, blocking sideloading via MDM, prohibiting installation of untrusted APKs on managed fleets, and prioritizing patches on devices with sensitive data; the trade-off of MDM-based sideload restrictions is reduced flexibility for developers and power users.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an integer overflow (CWE-190) affecting Android per CPE cpe:2.3:a:google:android, reported in multiple code locations within the Android platform. Integer overflows typically arise when an arithmetic operation produces a value outside the representable range of the integer type, leading to undersized buffer allocations, incorrect length checks, or out-of-bounds memory operations - any of which can be leveraged into memory corruption and subsequent code execution. Because Android relies on layered sandboxing (app UID isolation, SELinux, Mainline modules), an overflow that enables code execution in a privileged process can break out of an application sandbox into a higher-privilege context.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
4DescriptionCVE.org
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android devices running versions 14 through 16-qpr2 are vulnerable to a local privilege escalation attack enabling complete device control for attackers with device access; no public exploit identified at time of analysis. With no vendor patch available, organizations cannot address this threat through patching and must implement protective controls across all affected devices, creating material risk for enterprise BYOD programs and mobile workforces.
Enforce strict MDM policies including SELinux mandatory access control enforcement; restrict application sideloading and limit installation to enterprise-managed sources; monitor system logs for privilege escalation indicators (capability grants, permission changes); disable kernel module loading where operationally feasible; establish device replacement schedule for units unable to run patched Android versions; implement network isolation for affected high-risk devices; conduct forensic assessments of high-value devices for compromise indicators.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB