Google Android EUVD-2026-115568

Exploitation requires local code execution context on the device, i.e. a malicious or compromised app running on an affected Android build (14, 15, 16, 16-qpr2, or 17) that reaches the setNotificationListenerAccessGrantedForUserInternal path in NotificationManagerService. Per CVSS PR:N and the description's 'no additional execution privileges needed,' the attacking app needs no special granted privileges, and UI:N means no user interaction is required. Limiting factors: the attack vector is local (AV:L), so remote exploitation is not possible - an attacker must already have a foothold on the device; the flaw is confined to the listed Android versions. The specific input or configuration state that produces the policy desynchronization is not described in the available sources.

Signals are mixed and point to an important-but-not-emergency issue. The CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a locally-exploitable privilege escalation with high confidentiality, integrity and availability impact, consistent with the SSVC 'Technical Impact: total' rating. However, SSVC 'Exploitation: none' and 'Automatable: no' temper the urgency, and the vuln.today decision label is 'this_week' rather than act_now/emergency. There is no CISA KEV listing and no EPSS score in the provided data, so exploitation probability cannot be quantified from these sources; absence of EPSS is a data gap, not evidence of low risk. No public exploit is identified. Note a tension between the metrics and the mechanism: the CVSS vector encodes PR:N (no privileges), yet an Android local escalation-of-privilege of this class normally presupposes an already-installed local app as the execution context - PR:N here means that app needs no special granted privileges, not that the attack is remote. The high CIA impacts appear to derive from the SSVC 'total' technical-impact judgement rather than from a described mechanism, which is only characterized as a 'policy desynchronization due to improper input validation.'

A malicious or compromised unprivileged app already present on the device invokes the affected notification-listener access-grant path, causing a policy desynchronization that improper input validation fails to catch. The resulting inconsistent state is leveraged to escalate privileges locally with no user interaction. No public exploit code is identified at time of analysis, and the exact trigger is not described in the available sources.