Google Android EUVD-2026-115560

Exploitation requires local code execution on the device - in practice a malicious or compromised Android application - able to reach the queryRemoteConnectionServices path in the telecom ConnectionServiceWrapper; the flaw is a confused deputy where the privileged telecom service performs an action on the attacker's behalf, bypassing a permission check. Per the CVSS vector (AV:L/PR:N/UI:N) no granted privileges and no user interaction are needed, which removes the usual limiting factors. The principal limits on exploitation are: it is NOT remotely reachable (local access/app install required), it is confined to Android 14, 15, 16 and 16-qpr2, and privilege scope is unchanged (S:U). The specific configuration or state needed to make the service act as a deputy is not described in the available sources.

This is a local privilege-escalation flaw (CVSS 8.4, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in Android's telecom ConnectionServiceWrapper, classified as CWE-441 (confused deputy). The signals are moderately but not maximally alarming. The high base score is driven by the AV:L/PR:N/UI:N combination - a local attacker (in practice a malicious or compromised app) can trigger it with low complexity, no privileges and no user interaction, yielding full confidentiality, integrity and availability impact within the unchanged privilege scope (S:U). Critically, the input provides NO EPSS score, NO CISA KEV listing and NO public PoC reference, so there is no evidence of active exploitation or available exploit code. The vuln.today decision label is 'this_week' - meaningful but below act_now/emergency urgency. Signals are therefore consistent rather than conflicting: a genuinely high-severity local EoP on an extremely widely deployed platform, but with no current indication of in-the-wild use or published exploit. Treat it as a standard-priority patch item on the Android monthly cadence, not a drop-everything emergency, while recognizing the large attack surface. Missing data to note explicitly: EPSS probability is absent, so widespread-exploitation likelihood cannot be quantified from the input.

A malicious application installed on the device (or code already running locally with no special privileges) invokes queryRemoteConnectionServices in ConnectionServiceWrapper, abusing the telecom service as a confused deputy to perform an action it is not authorized for. Because no user interaction and no granted privileges are required, the app silently escalates to higher privileges on the device. No public exploit identified at time of analysis; the precise trigger beyond the confused-deputy abuse is not described in the available sources.