Google Android EUVD-2026-115413

Exploitation requires the ability to execute code locally on the affected Android device (AV:L) - for example via an installed malicious app or an already-compromised process; it is not remotely reachable over a network. Per the description, no additional execution privileges are needed and no user interaction is required, so once local code execution exists the escalation primitive is available against affected builds (Android 15, 16, 16-qpr2, 17). The limiting factor is the local-access prerequisite: an attacker must first obtain a foothold on the device before this use-after-free can be leveraged. The specific feature, configuration, or component ('multiple locations') that triggers the use-after-free is not described in the available sources.

This is a genuine high-severity local privilege escalation in Android (CVSS 8.4, CWE-416 use-after-free). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates a locally-exploitable flaw with low complexity, requiring no privileges and no user interaction, yielding total confidentiality, integrity, and availability impact on the affected component. The signals point toward a real but not emergency priority: the vuln.today decision label is 'this_week' rather than act_now/emergency, and the CISA SSVC framework records Exploitation: none and Automatable: no, with Technical Impact: total - so impact is severe but there is no evidence of in-the-wild activity or automated mass exploitation. There is no CISA KEV listing and no POC referenced, so this is not confirmed exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be compared against the other signals - that gap should be noted. The key nuance is that AV:L means an attacker must already be able to run code locally on the device (e.g., a malicious or compromised app), which bounds real-world risk despite the PR:N/UI:N rating; this is a post-foothold escalation primitive, not a remote entry point.

A malicious or compromised application running on an Android device with no special permissions triggers the use-after-free in the affected component to corrupt memory. By grooming the freed allocation, the attacker gains elevated privileges on the device without any user interaction. No public exploit code is identified at time of analysis, so this remains a theoretical-but-credible local escalation path.