Google Android EUVD-2026-115574

Exploitation requires local access to the affected device - AV:L means the attacker needs on-device code execution, typically via an installed malicious or compromised application, rather than network reachability. No user interaction is required (UI:N) and no additional execution privileges are needed (PR:N), so a running local context is sufficient to trigger the use-after-free. Limiting factors: the device must run an affected build (Android 16, Android 16-qpr2, or Android 17) and remain unpatched relative to the November 2026 bulletin; the exact vulnerable component and trigger path are not described in the available sources ('multiple locations'), so the precise prerequisite code path cannot be named.

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a local-vector (AV:L), low-complexity, no-privilege, no-interaction use-after-free yielding full confidentiality, integrity and availability impact - i.e. local privilege escalation. The vuln.today decision label is 'this_week', indicating elevated but not emergency priority. There is a notable internal conflict: the description states 'remote escalation of privilege,' while the CVSS vector encodes AV:L (local). Android Security Bulletins routinely use 'remote' loosely to mean 'no additional execution privileges needed' rather than true network reachability, and the vector's AV:L is the more precise signal - verify the true attack surface against the Android bulletin. No EPSS score, CISA KEV entry, SSVC automatable/technical-impact decision, or POC/exploit reference is present in the supplied data, so exploitation likelihood cannot be quantified from these inputs. On balance this is a genuinely high-severity memory-corruption EoP in an ubiquitous platform, but with no evidence of active exploitation or public exploit code it reads as a priority patch (monthly bulletin cadence) rather than a confirmed emergency.

A malicious or compromised low-privilege app (or local code path) on an affected Android device triggers the use-after-free in the vulnerable component, corrupting memory to gain elevated privileges without any user interaction. No public exploit code or POC reference is present in the supplied data. The local attack vector (AV:L) means the attacker already needs code execution or an installed app on the device.