EUVD-2026-115571
GHSA-m2mr-rj8h-9fww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious local app
-
DeliveryCraft intent for ContactsPickerActivity
-
ExploitTrigger confused-deputy intent redirection
-
ExecutionPrivileged handler executes forwarded intent
-
ImpactLocal escalation of privilege
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Exploitation requires an attacker-controlled process already present on the device - the flaw is in forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, where the activity forwards an attacker-supplied intent to a more privileged handler (classic confused-deputy intent redirection). No user interaction and no granted privileges are needed by the malicious component (PR:N/UI:N), but because the vector is local (AV:L), the attacker must first be able to run code or deliver an intent on the target device, typically via a separately installed malicious app. The issue is confirmed only for Android 17; devices on other versions or already carrying the November 2026 bulletin fix are not in the stated affected scope. |
| Impact | Signals point to a genuine but non-emergency local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, 8.4) describes a low-complexity local attack needing no privileges and no user interaction, yielding total compromise of the affected component - consistent with SSVC Technical Impact 'total'. However, SSVC Exploitation is 'none' and Automatable 'no', and the vuln.today decision label is 'this_week' rather than act_now/emergency, so this is a prioritize-but-not-drop-everything case. No EPSS score was provided and the vulnerability is not on CISA KEV; no public exploit or PoC reference is present in the input. The AV:L vector means exploitation requires code already running on the device (typically a malicious or compromised local app), which materially limits remote mass-exploitation despite the high base score. Net: a real, high-severity local EoP worth patching within the vendor's monthly cycle, not a high-CVSS-but-illusory issue, but also not evidence of active widespread exploitation. |
| Exploit ScenarioDerived | A malicious app already installed on an Android 17 device sends a crafted intent to ContactsPickerActivity, which (acting as a confused deputy) forwards it on to a more privileged handler, causing an action to run with privileges the malicious app does not itself hold. No user interaction is required, so the escalation can occur silently in the background. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Intent redirection in Android 17's ContactsPickerActivity lets a locally installed malicious app relay an attacker-controlled intent into a more privileged handler, gaining the privileges of that handler and thereby escalating from an ordinary app sandbox to a higher-integrity context (CVSS 8.4, AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H). The confused-deputy flaw sits in forwardToPreferredActionPickHandler within ContactsPickerActivity.kt and requires no user interaction and no permissions granted to the calling component, but the attacker must already be able to run code or deliver an intent on the device - typically through a separately installed application. Affected scope is stated as Android 17 only; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but non-emergency local privilege-escalation issue slated for remediation in the current patch cycle.
RemediationAI
Vendor-released fix: apply the November 2026 Android Security Bulletin update (https://source.android.com/docs/security/bulletin/2026/2026-11-01) to devices running Android 17, which is the primary and complete remediation for this issue. No workaround or compensating control is described in the available sources; because the flaw is a confused-deputy intent redirection inside a platform activity, the vendor's guidance is expected to be the platform update rather than a configuration change. As an interim exposure reduction measure consistent with the local attack vector, limit installation of untrusted applications on managed Android 17 devices, since exploitation requires an attacker-controlled component already present on the device; note this does not remove the underlying flaw and is not a substitute for the bulletin update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a confused-deputy intent redirection (CWE-441) in Android's platform contacts-picker UI. An exported activity component, ContactsPickerActivity, receives an intent from a caller and passes it down through forwardToPreferredActionPickHandler, which forwards it to a preferred action handler that runs with greater privilege than the original caller. Because the activity does not adequately establish that the forwarded intent belongs to the same trust domain as the sender, a malicious app installed on the device can supply a crafted intent and have it executed under the receiving component's identity rather than its own, breaking the Android application sandbox boundary. The publish data maps the issue to cpe:2.3:a:google:android:* and EUVD scopes the affected platform version as Android 17; the precise conditions under which the forwarding path is reachable, and any additional intent-filter or component-export prerequisites, are not described in the available sources. The vulnerability is low in attack complexity (AC:L) and needs neither privileges (PR:N) nor user interaction (UI:N), but it is local (AV:L), so the attacker must first land or execute a component on the target device.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local because a co-resident app must deliver the intent (AV:L); no privileges or interaction needed (PR:N/UI:N); confused-deputy redirection grants full component compromise (C:H/I:H/A:H), scope unchanged.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
CVE-2026-55271 is a high-severity intent redirection vulnerability in Android 17's ContactsPickerActivity that allows a locally installed malicious app to escalate privileges and access sensitive data. This affects any organization with Android 17 devices, potentially leading to unauthorized access to contact information and other protected resources, undermining the integrity and confidentiality of corporate data. Leadership should prioritize remediation to prevent insider threats or malware from exploiting this flaw to compromise device security.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting app installations to trusted sources via MDM, implementing application whitelisting, and monitoring for suspicious inter-app communication patterns. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB