Android EUVD-2026-115406

Exploitation requires local code execution on the device - specifically an attacker-controlled app installed on an affected Android build (14, 15, 16, 16-qpr2, or 17) reaching the deliverResult path in AppTimeTracker.java. No additional execution privileges and no user interaction are required (PR:N/UI:N), so the malicious app needs no special permissions once present. The limiting factor is the local attack vector (AV:L): the attacker must first get an app onto the device (e.g., via sideloading or a malicious download), as there is no remote exploitation path; the flaw is a confused deputy (CWE-441) where a privileged component performs a background activity launch on the unprivileged caller's behalf.

Signals are moderately consistent but point to elevated rather than emergency risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, 8.4 HIGH) describes a local, low-complexity privilege escalation needing no privileges and no user interaction - meaning a malicious or compromised app already present on the device, not a remote attacker. SSVC reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no, but Technical Impact=total, which is why Google/vuln.today rate it 'this_week' rather than 'act_now'. There is no CISA KEV listing and no EPSS score supplied, so exploitation probability cannot be quantified; the only reference is the Android November 2026 security bulletin, with no PoC or exploit reference provided. The AV:L vector is consistent with the description ('local escalation of privilege'), so there is no network-vs-local conflict here. Bottom line: a high-impact but local EoP typical of Android monthly patches - a real priority to patch on the normal urgent cadence, not a widely-exploited emergency. Missing EPSS and absence of any PoC mean the real-world exploitation likelihood is currently unquantified rather than confirmed low.

A user installs a malicious or trojanized app that requests no special permissions. The app abuses the confused-deputy flaw in AppTimeTracker's deliverResult to have a more-privileged system component launch an activity in the background on its behalf, escalating the app's effective privileges locally without any user interaction. No public exploit code has been identified at time of analysis.