Google Android EUVD-2026-115558

Exploitation requires the attacker to already have local code execution on the device, typically via an installed application; the flaw lies in multiple functions of SaveUi.java where a logic error allows bypassing package-installation requirements. Per the CVSS vector no user interaction is needed (UI:N) and no additional execution privileges are required (PR:N / 'no additional execution privileges needed'). The principal limiting factor is the local attack vector (AV:L): this is not remotely reachable and presumes a malicious app already present on an affected build (Android 14, 15, 16, 16-qpr2, or 17); the exact feature-level trigger within SaveUi.java is not described in the available sources.

This is a legitimately high-severity local privilege-escalation issue (CVSS 8.4) but the signals converge on a 'patch-this-week, not emergency' posture rather than a drop-everything fire. The CVSS vector (AV:L/AC:L/PR:N/UI:N) describes a local, low-complexity flaw requiring no user interaction and, per the vector's PR:N, no additional privileges - consistent with the description that a malicious local app can bypass package-installation requirements with 'no additional execution privileges needed.' Note the internal tension worth flagging: PR:N normally denotes an unauthenticated attacker, yet this is a LOCAL vector (AV:L), so in practice it presumes an attacker who already has code running on the device (e.g., an installed app) but holds no special permissions - treat 'unauthenticated' here as 'no privileged app context required,' not 'remote.' The SSVC framework reports Exploitation: none and Automatable: no, with Technical Impact: total - i.e., full compromise if triggered, but no evidence of exploitation and not mass-automatable (it needs local presence). There is no CISA KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the input. The vuln.today Decision label is 'this_week,' which aligns with high impact + absence of active exploitation. Bottom line: a real priority to patch on the normal monthly-bulletin cadence, not a zero-day emergency.

A user installs a malicious or trojanized app that holds no special permissions. Leveraging the logic error in SaveUi.java, the app bypasses package-installation requirements to install or elevate components it should not be allowed to, achieving local privilege escalation without any user interaction. No public exploit code is identified in the available sources.