Google Android EUVD-2026-115422

Exploitation requires local access to an affected device - in practice, a malicious or already-compromised unprivileged app running on the device - against Android 16-qpr2 or Android 17 builds. Per CVSS (PR:N/UI:N), no pre-existing privileges and no user interaction are needed once the attacker has on-device code execution. The principal limiting factors are: (1) the Local attack vector, which precludes remote exploitation and requires the attacker to first place/run code on the device; and (2) version scope, limited to Android 16-qpr2 and Android 17. The exact feature or component acting as the 'confused deputy' is not described in the available sources ('multiple locations').

Severity signals and real-world-risk signals diverge here. CVSS 3.1 rates this 8.4 (High) driven by total impact (C:H/I:H/A:H) and a low-complexity, no-privilege, no-interaction trigger - but the attack vector is Local (AV:L), so exploitation requires the attacker to already be running code on the device, typically via a malicious or compromised app. The SSVC framework reinforces this nuanced picture: Technical Impact is 'total,' yet Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no,' which is why the vuln.today priority resolves to 'this_week' rather than act_now/emergency. No EPSS score was supplied, this CVE is NOT in CISA KEV, and no PoC or exploit reference is present in the input. Net assessment: a genuine, high-impact local privilege-escalation issue worth patching on a near-term (this-week) cadence, but not a drop-everything internet-exposed emergency - the local-only vector and absence of any exploitation evidence meaningfully lower immediate risk versus the raw 8.4. Note the AV:L/PR:N combination describes an unprivileged on-device attacker, not a remote one; do not read 8.4 as remotely reachable.

A malicious or compromised app already installed on an affected device invokes a more-privileged Android component that performs an action on the caller's behalf without verifying the caller's permissions (a confused-deputy flaw), bypassing permission enforcement to escalate its own privileges. No user interaction and no additional execution privileges are required. No public exploit was identified at the time of analysis.