Android EUVD-2026-33799

Attacker must already have code execution on the device as an installed third-party app (CVSS PR:L, AV:L) - typically achieved by tricking the user into installing a malicious APK or via a malicious app on a secondary store; no further user interaction is required once installed (UI:N). The target device must run Android 14, 15, 16, or 16-qpr2 with a security patch level prior to 2026-06-01, and the attacker app must declare intent filters for the domain it wishes to hijack. Exploitation is limited to local context (no remote/network reachability), is bounded to App Link / domain-handler routing rather than arbitrary kernel privileges, and is gated by Play Protect and sideload restrictions that may detect or block the malicious app before it can register handlers.

CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local, low-complexity, low-privilege escalation - consistent with a malicious app already installed on the device. EPSS exploitation probability is 0.01% (1st percentile) and the CVE is not in CISA KEV, indicating no observed mass exploitation. SSVC-style reading: exploitation is not active, automation is limited (requires a locally installed attacker app and a victim tapping or being directed to a hijacked link), and technical impact is total for the targeted app's link domain (high confidentiality/integrity/availability for credentials and data flowing through the hijacked link). Net real-world priority is moderate - it is a meaningful building block in a malware chain (phishing of OAuth/banking deep links, credential interception) rather than a wormable RCE. Note a tension worth flagging: the public Tags label this 'Privilege Escalation' and Google's description says the same, but the underlying primitive is link hijacking; defenders should treat the EoP framing as the security-boundary outcome, with link-handler takeover as the mechanism.

A user installs a seemingly benign app (e.g., from a sideloaded APK or a low-reputation store) that declares intent filters for a target domain such as a bank or SSO provider. Exploiting the logic error in approvalLevelForDomainInternal, the malicious app is returned as the preferred handler for that domain's App Links without being properly verified, so when the user taps a magic-link email or OAuth redirect the URL is delivered to the attacker's app, which harvests tokens or credentials and silently forwards the user to the real site. No public PoC has been published at time of analysis.