EUVD-2026-33794
GHSA-m46h-7gfx-97wc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryInvoke setGlobalProxy with crafted input
-
ExploitTrigger persistence desync in DevicePolicyManagerService
-
ExecutionBypass device policy boundary
-
ImpactEscalate to elevated privileges on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Attacker must already have local code execution on the Android device with at least low-level app privileges (CVSS PR:L), typically achieved by installing or running a malicious app on the target running Android 14, 15, 16, or 16-qpr2 before the 2026-06-01 security patch level. No user interaction is required (UI:N) and no special device configuration is called out - the vulnerable setGlobalProxy path is in the standard framework DevicePolicyManagerService. Exploitation is limited by the local-only attack vector (AV:L), meaning remote-only attackers without an initial app foothold cannot reach this code path, and by the need for the caller to be able to invoke the DevicePolicyManager API surface that exposes setGlobalProxy. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 7.8 and indicates a local attacker with low privileges can achieve high confidentiality, integrity, and availability impact without user interaction - consistent with a meaningful EoP primitive. However, multiple independent risk signals diverge sharply from the raw CVSS: EPSS is 0.01% (1st percentile), SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, and the bug is not present in CISA KEV. Together these suggest real but currently theoretical risk - a useful primitive in a chained attack (e.g., from a malicious app sandbox) rather than a standalone, widely exploited issue. Note one tension worth flagging: CVSS rates Technical Impact at the highest tier on all three CIA axes while SSVC characterizes Technical Impact as only 'partial', which is consistent with this being a policy-desync EoP rather than full kernel/root compromise. |
| Exploit ScenarioDerived | A malicious app installed on the device - for example sideloaded or delivered through a compromised Play Store account - invokes setGlobalProxy with crafted input that triggers the persistence desync. The desynchronized policy state allows the app to escape its sandbox-level privileges and gain higher-privileged device control without prompting the user. No public exploit is identified at time of analysis, but the local-only attack vector and lack of user interaction make this a plausible second-stage primitive in a chained mobile attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 02, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) stems from improper input validation in the setGlobalProxy method of DevicePolicyManagerService.java, causing a desynchronization in persistence state. A local attacker with low-level privileges can exploit this without user interaction to elevate to higher privileges on the device, with no public exploit identified at time of analysis and an EPSS score of 0.01% indicating minimal observed exploitation activity.
Earlier versions of this analysis (2)
Local privilege escalation in Android 14, 15, 16, and 16-qpr2 via DevicePolicyManagerService's setGlobalProxy method, where improper input validation causes a persistence desync that can be abused by a low-privileged local app to gain elevated capabilities. Exploitation requires no user interaction but does require code execution on the device; no public exploit is identified at time of analysis and EPSS is very low (0.01%).
Local privilege escalation in Android's DevicePolicyManagerService affects Android 14, 15, 16, and 16-qpr2 through an improper input validation flaw in the setGlobalProxy method that creates a desynchronization between in-memory and persisted proxy policy state. Any locally executing code - including untrusted apps - without pre-existing elevated privileges can exploit this desync to gain unauthorized influence over device policy, with low impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.01% (1st percentile) reflects very low current exploitation probability.
RemediationAI
Apply the June 2026 Android security patch level (2026-06-01 or later) as published in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-06-01; OEM-shipped builds should incorporate the corresponding AOSP framework fix to DevicePolicyManagerService. Exact AOSP tagged release versions are not enumerated in the available input data beyond the affected branches (Android 14, 15, 16, 16-qpr2), so confirm the patch level via Settings > About phone > Android security update on each device. Where immediate patching is not possible, compensating controls include restricting installation of untrusted apps via managed Google Play or MDM allowlisting (trade-off: reduces user flexibility), enforcing strict Device Admin / Device Owner provisioning policies so untrusted apps cannot reach DevicePolicyManager APIs (trade-off: increases enrollment friction), and monitoring for anomalous proxy-policy changes via EMM telemetry where supported (trade-off: detection-only, not preventive).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DevicePolicyManagerService is a core Android system service that manages device administrator policies, including network proxy settings applied across the device. The setGlobalProxy method allows authorized callers to configure a system-wide proxy, and its implementation persists policy state across reboots. The root cause is CWE-20 (Improper Input Validation): insufficient validation of inputs to setGlobalProxy creates a desynchronization between the in-memory policy state and the persisted state, which can be leveraged to bypass intended policy enforcement boundaries. CPE data confirms the affected product is Google Android (cpe:2.3:a:google:android), and the bug lives in framework code shared across major Android branches.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
7DescriptionCVE.org
In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A privilege escalation vulnerability in Google Android 14, 15, 16, and 16-qpr2 allows attackers with local device access to elevate privileges without user interaction, potentially enabling compromise of sensitive data on affected smartphones and tablets. Organizations managing Android device fleets should prioritize inventory assessment and interim mitigation while monitoring for vendor patch availability.
Restrict physical and logical access to vulnerable devices; implement device-level monitoring and logging of privilege escalation attempts; enforce strong device authentication and screen-lock policies; restrict high-privilege application installation where operationally feasible; maintain comprehensive device access and activity logs; establish rapid patch deployment procedures for Android security updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB