EUVD-2026-115426
GHSA-57mx-3pmf-gmxr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious local app
-
DeliveryInvoke vulnerable permission-check path
-
ExploitTrigger uncaught exception (CWE-248)
-
ExecutionBypass permission enforcement
-
ImpactEscalate to elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Requires local presence on the device - i.e., an attacker-controlled app already installed and executing on an affected Android build (14, 15, 16, 16-qpr2, or 17). Per the description and CVSS vector, no additional execution privileges and no user interaction are required once local code runs, so the main limiting factors are: (1) the need for prior local code execution (AV:L - not remotely reachable), and (2) running an unpatched build predating the 2026-11-01 Android Security Bulletin. The specific feature, permission, or configuration whose check is bypassed is not detailed in the available sources. |
| Impact | Signals are consistent but point to moderate real-world urgency rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) yields 8.4 because, once local code is running, exploitation is low-complexity, needs no privileges or user interaction, and delivers full C:H/I:H/A:H impact - but AV:L means the attacker must already have local presence on the device (typically a malicious or compromised app), which is the single biggest limiting factor. EPSS is very low (0.12%, 2nd percentile), and there is no CISA KEV listing and no public exploit reference in the supplied data, so there is no evidence of active or imminent widespread exploitation. The vuln.today Decision label is 'this_week', which aligns with a serious-but-not-emergency local privilege-escalation flaw that should be patched on the normal monthly Android cadence. Note one tension worth verifying: CWE-248 (uncaught exception) describing a 'permission bypass' with PR:N is unusual for a local privesc - the Android bulletin does not, in the data provided, specify the exact triggering component or SAPI, so the precise mechanism is not described in the available sources. |
| Exploit ScenarioDerived | A locally installed malicious or low-privilege Android app triggers an uncaught exception in an affected permission-check path, causing the permission enforcement to be bypassed and allowing the app to elevate to higher privileges without any user interaction. No public exploit code is referenced in the provided data, and the trigger location is not described in the available sources. Exploitation requires the attacker to already have an app running locally on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 allows an app already running on the device to bypass a permission check by inducing an uncaught exception, yielding high confidentiality, integrity and availability impact within the local security boundary. The CVSS vector (AV:L/AC:L/PR:N/UI:N) means no pre-existing privileges and no user interaction are needed once attacker-controlled code executes locally; the flaw is not remotely reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.12% (2nd percentile), so signals point to moderate, patch-cycle urgency rather than an emergency - fixed builds are published in the Android Security Bulletin dated 2026-11-01.
RemediationAI
Patch availability is per vendor advisory: Google publishes the fix in the Android Security Bulletin dated 2026-11-01 (https://source.android.com/docs/security/bulletin/2026/2026-11-01), and remediation consists of updating affected devices to a build at or above the patch level specified in that bulletin for Android 14, 15, 16, 16-qpr2 and 17; no separate fix version string is available in the supplied data, so the bulletin's patch-level entries must be used to confirm a given device is covered. Because the advisory does not name the subsystem, permission or service whose check is bypassed, no targeted workaround (disabling a specific feature, blocking a specific port, or restricting a specific endpoint) can be derived from the available sources, and updating to the fixed build is the only complete fix identified. As a scope-reduction measure consistent with the AV:L precondition, limiting installation of untrusted or sideloaded applications and constraining which apps hold the ability to run on the device reduces the population of attackers who can reach the flaw, but this does not remediate the underlying exception-handling defect and carries usability and administrative cost; organisations that cannot immediately update carrier- or OEM-locked devices should track the bulletin patch level per device model and treat unpatched units as locally exposed to any app already installed on them.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-248 (Uncaught Exception). The Android source bulletin describes the defect as a permission bypass occurring in multiple locations where an exception raised during a permission or access check is not handled, so the check does not complete as intended and the calling code proceeds with privileges it should not hold - a classic fail-open outcome of unhandled exception flow. Per the CPE (cpe:2.3:a:google:android) and EUVD version data, the affected platform builds are Android 14, 15, 16, 16-qpr2 and 17, meaning the issue spans several release branches and one quarterly platform release. The advisory does not identify the specific subsystem, permission, service or binder interface whose check is bypassed, so the precise trigger path, the exception type involved, and whether the bypass is reachable only from a specific app context all remain unverified from the available sources; the description only states that multiple locations are involved. Because exploitation requires local code execution on the affected build (AV:L) and no additional execution privileges or user interaction (PR:N/UI:N), the practical attack model is a malicious or compromised installed app escalating from its own sandboxed privilege level, not a remote or network-facing vector.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector requires a running app (AV:L); description states no privileges or user interaction needed (PR:N/UI:N) and the privesc yields full C/I/A impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
CVE-2026-59004 is a high-severity local privilege escalation flaw affecting Google Android 14, 15, 16, 16-qpr2, and 17, allowing a malicious app to bypass security checks and gain elevated access to sensitive data and device functions. This poses a significant risk to the organization's mobile workforce, as a compromised device could lead to unauthorized access to corporate email, documents, and internal applications, potentially resulting in data breaches or operational disruption.
No vendor-released patch identified at time of analysis. Enforce a strict mobile application vetting policy, prohibit sideloading of apps from unknown sources, and restrict installation to approved app stores via MDM. Deploy mobile threat defense (MTD) solutions to detect malicious app behavior, and enforce device encryption and remote wipe capabilities to limit impact if exploitation occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB