Google Android EUVD-2026-33798

Exploitation requires local access to the target device - either physical access or an installed application running on an Android 16-QPR2 device, consistent with the CVSS local attack vector (AV:L). Within that local context, no additional execution privileges are required (PR:N per CVSS) and no user interaction is needed (UI:N per CVSS). The critical limiting condition is that the target device must be actively enrolled in an Android supervision or MDM program that provisions DisableSupervisionActivity - on unmanaged consumer devices, the supervision data that is deleted does not exist, substantially limiting meaningful impact. Exploitation is confirmed only against Android 16-QPR2; other Android versions are not confirmed affected. The attack is further limited to scenarios where a malicious actor can install or run an application locally, or has direct physical access - remote unauthenticated exploitation is not possible given the local attack vector.

The CVSS 6.8 score with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N presents a nuanced risk profile. The local attack vector (AV:L) materially constrains the attack surface relative to network-exploitable flaws, but the combination of no required privileges (PR:N), no user interaction (UI:N), and low complexity (AC:L) means any app or user with device access can trivially trigger the condition. The high confidentiality impact (C:H) reflects access to supervision-controlled data, while low integrity impact (I:L) reflects the deletion or modification of supervision records. EPSS at 0.01% (1st percentile) confirms extremely low observed exploitation probability, and the vulnerability does not appear in CISA KEV. The real-world risk is concentrated in enterprise and education deployments using Android MDM supervision - for those environments, the privilege escalation impact is significant because removing supervision data bypasses the organizational security boundary. For unmanaged consumer devices, practical impact is minimal as no supervision data exists to be targeted. No conflicting signals were identified between CVSS and description; the local vector is consistent with the described attack path.

An unprivileged malicious application installed on an enterprise-managed Android 16-QPR2 device directly invokes DisableSupervisionActivity, triggering the missing null check in onCreate() and causing the supervision enrollment data to be deleted. With MDM supervision controls removed, the app or user gains access to device capabilities and data that were previously restricted by organizational policy - such as unenforced app restrictions, bypassed screen-time controls, or disabled remote wipe policies. No public exploit identified at time of analysis, but the low complexity (AC:L) indicates the mechanism would be straightforward to reproduce given source access.