Android ExternalStorageProvider EUVD-2026-115551

Exploitation requires the attacker to execute code locally on the device (AV:L) - in practice, a locally-installed app - since there is no remote or network vector. Per the CVSS vector no privileges (PR:N) and no user interaction (UI:N) are needed, and the description states no additional execution privileges are required, so a low-privilege or permission-less app suffices once present. The specific trigger is use of the directory-tree access path handled by shouldBlockDirectoryFromTree in ExternalStorageProvider (the Storage Access Framework document-tree interface); the available sources do not detail the exact logic-error condition beyond that it fails to block access to protected directories. The principal limiting factor is the local-access precondition: the attacker must already be able to run on the target device, which constrains this to malicious-app or post-compromise scenarios rather than drive-by remote attacks. Affected Android version range per the November 2026 bulletin also limits the exposed population.

This is a genuine, well-attested Android access-control flaw (CWE-284) in the shouldBlockDirectoryFromTree method of ExternalStorageProvider.java, where a logic error lets a local actor reach data that should be blocked from the document tree. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.4) describes a locally-exploitable issue with no privileges and no user interaction required, which is consistent with the description's 'local escalation of privilege with no additional execution privileges needed' - so the severity signal and the narrative agree. Tempering that, the attack vector is LOCAL (AV:L), not network, so exploitation presupposes an attacker already able to run code on the device, typically a malicious or compromised app; this is not a remotely-reachable bug. No EPSS probability was provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating it should be prioritized but is not flagged act_now/emergency. Net: a real, high-severity local privilege-escalation issue warranting prompt patching in the normal Android monthly cycle, but not an active-exploitation emergency on current signals. Note the I:H/A:H impact rating is Android's conventional scoring for EoP; the description substantiates confidentiality/integrity impact (access to protected data) more directly than availability impact - verify the availability claim against the vendor bulletin.

A user installs a malicious or compromised app that requires no special storage permissions. The app invokes the Storage Access Framework document-tree interface and exploits the faulty directory-blocking logic in ExternalStorageProvider to reach protected directories and read data it should not be able to access, with no user interaction or additional privileges. No public exploit code or PoC is known at time of analysis.