Google Android EUVD-2026-115607

Requires a local, already-installed application on the affected Android device; the CVSS PR:N/UI:N reflects that the attacker app needs no granted permissions and no user interaction, abusing the privileged Wifi system service via the startTetheredHotspotRequest code path. Limiting factors: exploitation is local only (AV:L) - the attacker must already have code execution on the device (e.g., a malicious app), so there is no remote network path; exploitation is bounded to the listed Android branches (14, 15, 16, 16-qpr2, 17), and SSVC reports it is not automatable. Fix is delivered through the November 2026 Android Security Bulletin.

This is a genuinely high-severity local privilege escalation (CVSS 8.4) but not an active-exploitation emergency. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates local attack vector, low complexity, no privileges and no user interaction required, with total confidentiality/integrity/availability impact - consistent with a confused-deputy (CWE-441) permission bypass where an unprivileged local app abuses the Wifi service's privileges. The SSVC framework agrees on impact (Technical Impact: total) but reports Exploitation: none and Automatable: no, meaning no evidence of exploitation and no mass/automatable path. No EPSS score, no CISA KEV listing, and no PoC reference are present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is this_week, not act_now/emergency, which matches the signal mix: high technical impact but no observed exploitation. Net: a real priority warranting prompt patching in the normal monthly-bulletin cycle, driven by severity/impact rather than by any confirmed in-the-wild activity. One caveat - PR:N here reflects Android's model where a zero-permission local app is the attacker; it still requires code already running on the device.

A user installs a malicious or compromised app that holds no special permissions. By calling the vulnerable startTetheredHotspotRequest path in WifiServiceImpl, the app induces the privileged Wifi system service to act on its behalf (confused deputy), bypassing a permission check and escalating privileges locally without any user interaction. No public exploit code is identified at time of analysis.