Google Android EUVD-2026-115577

Exploitation requires the attacker to already be able to run code locally on the device, i.e. a malicious or compromised app installed on an affected Android 17 build. Per CVSS AV:L/PR:N/UI:N, that app needs no special execution privileges and no user interaction, and it abuses a privileged component (confused deputy) to execute sensitive USSD codes on its behalf. Limiting factors: the attacker must first get an app onto the device (so this is a local privilege-escalation primitive, not remote), and the device must be running an affected Android 17 version; the exact vulnerable functions and configurations are not enumerated in the available sources.

This is a genuine prioritization candidate but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.4 HIGH) describes a locally-reachable confused-deputy flaw (CWE-441) that a malicious app with no granted permissions and no user interaction can trigger to gain high confidentiality, integrity, and availability impact - a classic Android local privilege-escalation profile where AV:L reflects on-device code execution rather than network reach. The vendor decision label is 'this_week', consistent with a serious-but-not-top-tier Android bulletin item. Signals are, however, incomplete: no EPSS probability, no CISA KEV listing, and no POC are present in the input, so real-world exploitation likelihood cannot be quantified. The absence of KEV/EPSS does not contradict the severity - it simply means there is no evidence of active or at-scale exploitation, which fits a flaw that requires a hostile app to already be running on the device. No signals conflict; the main gap is the lack of exploitation-probability data and any confirmed exploit code.

A user installs a seemingly benign app that holds no sensitive Android permissions. Exploiting the confused-deputy flaw, the app causes a privileged system component to execute sensitive USSD codes on its behalf - with no user interaction - to perform privileged telephony actions and escalate its effective privileges on the device. No public exploit code is identified in the provided data.