EUVD-2026-33793
GHSA-48h4-rxpg-gg8j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconInstall malicious app on device
-
DeliveryApp runs in background with normal privileges
-
ExploitTrigger Activity configuration change
-
InstallInvoke flawed resumeConfigurationDispatch path
-
C2Bypass Background Activity Launch restriction
-
ExecuteLaunch privileged activity or overlay UI
-
ImpactEscalate to higher-privilege context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | The attacker must have code execution on the device as an installed application with at least low privileges (PR:L) - typically a normal-user Android app sideloaded or distributed via an app store - running on Google Android 16-qpr2. Exploitation requires triggering the resumeConfigurationDispatch path in ActivityRecord.java, which is reached via Activity configuration changes, and no user interaction is required (UI:N). Exploitation is LIMITED to devices already on the Android 16-qpr2 branch (recent Pixel/QPR channel), requires local app installation rather than remote delivery, and the malicious app must survive Google Play Protect and any MDM allow-listing. |
| Impact | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects local-only attack vector requiring an installed app with low privileges but no user interaction, with high impact across CIA. Counterbalancing this, EPSS is exceptionally low at 0.01% (1st percentile) and CISA SSVC scores Exploitation as 'none', Automatable 'no', and Technical Impact only 'partial' - a notable contrast to the CVSS 'H' impact ratings across CIA. There is no KEV listing and no public exploit. The realistic priority is moderate-to-low for general fleets but higher for high-value targets where a malicious app could be sideloaded; the BAL-bypass class is historically attractive to commercial spyware and tap-jacking chains, but the Android 16-qpr2 limited version footprint constrains exposure to recent Pixel/QPR-channel devices rather than the broader ecosystem. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from a third-party store or a malicious Play Store submission; the app, running with normal user-level privileges in the background, triggers a configuration-change code path that invokes resumeConfigurationDispatch and exploits the logic error to launch a privileged activity it should not be allowed to start. This could be used to overlay a phishing UI on top of banking/credential prompts or to chain into a higher-privilege component, all without any tap or consent from the victim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 03, 2026
Local privilege escalation in Google Android 16-qpr2 stems from a logic error in ActivityRecord.java's resumeConfigurationDispatch routine that permits unauthorized background activity launches (BAL bypass). A local attacker with low privileges can elevate to higher privileges without any user interaction, with no public exploit identified at time of analysis and an EPSS score of 0.01% indicating very low near-term exploitation probability.
Earlier versions of this analysis (2)
Local privilege escalation in Google Android 16-qpr2 stems from a logic error in the resumeConfigurationDispatch method of ActivityRecord.java that permits unauthorized background activity launches (BAL). A low-privileged local app can elevate its scope without user interaction, with no public exploit identified at time of analysis and a very low EPSS score (0.01%) indicating minimal current exploitation interest. SSVC rates exploitation as none and the issue is non-automatable, but CVSS 7.8 reflects high confidentiality, integrity, and availability impact once triggered.
Background Application Launch (BAL) restriction bypass in Google Android 16-QPR2 allows a locally present attacker to escalate privileges without any additional permissions or user interaction. The logic error in resumeConfigurationDispatch within ActivityRecord.java undermines Android's built-in BAL protection mechanism, enabling unauthorized background activity launches that can be leveraged for local privilege escalation. No public exploit has been identified at time of analysis, and EPSS scores (0.01%, 1st percentile) indicate minimal observed exploitation activity.
RemediationAI
Apply the Android security patch level dated 2026-06-01 or later as documented in the Google Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-06-01; on Pixel devices this arrives via the June 2026 OTA, while OEM devices depend on each vendor's downstream rollout. Patch available per vendor advisory - no independently confirmed standalone fix version beyond the monthly bulletin reference was provided in the available data. As compensating controls until the patch lands, restrict sideloading via MDM 'install unknown apps' policies, enforce Google Play Protect, and on managed fleets disable installation of non-Play-vetted apps; these reduce the attack surface (a local app is required) at the cost of blocking legitimate enterprise sideload workflows. Generic 'restrict background activity' user settings are not a reliable mitigation because the flaw bypasses the very BAL control that enforces them.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in ActivityRecord.java, a core component of Android's Activity Manager that tracks the state and lifecycle of activities within the framework. The resumeConfigurationDispatch path is invoked during configuration changes (orientation, locale, density) and contains a logic error that fails to enforce Background Activity Launch (BAL) restrictions - a security control introduced in Android 10+ to prevent apps from arbitrarily starting activities while in the background. The CWE-693 (Protection Mechanism Failure) classification confirms this is not a memory-corruption issue but rather a bypass of an existing security control, allowing an untrusted app to launch privileged activities or hijack the foreground in a way that should normally be blocked.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
7DescriptionCVE.org
In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A privilege escalation vulnerability in Google Android 16-qpr2 (CVE-2026-0077) could allow attackers with device access to gain elevated permissions and access sensitive device functions, potentially impacting any enterprise with Android devices in use. With no public exploit identified at time of analysis and minimal near-term exploitation risk (0.0% EPSS), the immediate threat is low, but this affects a widespread platform requiring proactive monitoring for vendor patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce SELinux policy restrictions on untrusted applications, implement strict Android app permission controls limiting background activity, restrict app installations to managed app stores only, and maintain activity monitoring for unauthorized privilege escalations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB