Google Android EUVD-2026-115435

Exploitation requires local access to the device: the attacker must already be able to run code on the device, typically via a malicious or compromised unprivileged app, since the vector is AV:L (not network-reachable). Within that constraint the barrier is low - AC:L, PR:N and UI:N mean no privileges and no user interaction are needed once local code execution exists, and it affects Android 16, Android 16-qpr2, and Android 17. The available sources state the flaw exists 'in multiple locations' but do not name the specific feature, service, or component that must be reached, so the exact triggering surface is not described in the available sources. The primary limiting factor is the local-access prerequisite; there is no indication of a non-default configuration being required.

This is a genuine high-severity local privilege escalation in Android, but the signals point to prioritized-but-not-emergency rather than drop-everything. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 8.4) describes a locally-reachable integer-overflow-driven out-of-bounds write (CWE-787) that needs no user interaction and no prior privileges, yielding full confidentiality, integrity and availability impact on the affected component - a classic path for a malicious or compromised unprivileged app to gain elevated privileges. Against that, the exploitation-likelihood signals are low: EPSS is 0.11% (1st percentile), the CVE is NOT on the CISA KEV list (no confirmed active exploitation), and there is no public exploit identified at time of analysis. The vuln.today Decision label is 'this_week', consistent with a serious EoP that should be patched promptly via the monthly Android cycle but is not under mass exploitation. There is no contradiction among the signals here: high intrinsic severity (local EoP) paired with low current exploitation probability, which typically reflects that no weaponized exploit is yet circulating - not that the flaw is unimportant. Note the AV:L designation means this is strictly local; it is not remotely reachable over the network, which materially limits the threat to attackers who already have code-execution/app-install footing on the device.

A user installs a malicious or trojanized app (or an attacker leverages an already-compromised unprivileged app) that invokes the vulnerable code paths with crafted inputs that trigger the integer overflow and resulting out-of-bounds write. With no user interaction and no special privileges required, the overflow corrupts memory to escalate privileges locally on the device. No public exploit has been identified at time of analysis, so this remains a plausible but not-yet-demonstrated chain.