Google Android EUVD-2026-115387

Requires a locally installed, unprivileged application running on the device (AV:L): the attacker must already execute code on the target, so there is no remote vector. Given that app context, the confused-deputy flaw in AddAccountSettings (run of AddAccountSettings.java) lets the privileged component launch a background activity on the attacker's behalf with no additional permissions and no user interaction, per the description. Limiting factors: the attacker must first get an app installed/running on the device; exploitation is confined to the affected Android versions (14, 15, 16, 16-qpr2, 17); and SSVC rates it non-automatable, so it does not lend itself to scalable mass exploitation.

The signals point to a serious-but-not-emergency local privilege escalation. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a local attack requiring no privileges and no user interaction, with total confidentiality, integrity, and availability impact on the device - consistent with the CWE-441 confused-deputy pattern where a privileged system component (AddAccountSettings) is tricked into launching a background activity on behalf of a lower-privileged caller. The SSVC framework tempers this: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (it requires local code execution on the device rather than scalable remote delivery), while Technical Impact is 'total' - matching the high CVSS impact metrics. There is no CISA KEV listing and no EPSS score supplied, and no PoC or exploit reference appears in the input, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' which aligns with the SSVC profile: a high-impact local EoP worth prompt patching in Android's monthly cycle but not an active-exploitation emergency. The CVSS AV:L/PR:N combination is internally consistent for Android (a locally installed, unprivileged app is the typical attacker), so no conflict is evident between the vector and the description. The main limiting factor is the local attack vector: the attacker must already run code on the device.

A user installs a malicious or trojanized app that holds no special permissions. The app abuses the confused-deputy flaw in AddAccountSettings to have the privileged Settings component launch a background activity on its behalf, with no user interaction or prompt, escalating the attacker's effective privileges on the device. No public exploit code is identified in the available data.