EUVD-2026-33802
GHSA-q687-8858-63rc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain shell-user access via ADB or compromised app
-
DeliveryIdentify vulnerable launcher entry point
-
ExploitInvoke over-privileged shell capability
-
ExecutionExecute code in launcher process context
-
ImpactEscalate to elevated privileges on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already hold shell-user (UID 2000) privileges on the target Android device, typically obtained through ADB access (USB debugging enabled and the host workstation authorized), a previously installed application granted shell-equivalent capabilities, or physical hands-on access to an unlocked device. The vulnerability requires no user interaction once shell access is held (UI:N) and no additional execution privileges beyond the shell user (PR:L). Limiting factors: the device must be running an unpatched Android 14, 15, 16, or 16-qpr2 build; remote exploitation over the network is not possible (AV:L); and attackers without an existing local foothold cannot reach the vulnerable code path. |
| Impact | The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects high impact but local access requirements with low privileges (shell-level). SSVC framework reports Exploitation: none and Automatable: no, indicating no observed in-the-wild use and no path for mass automated exploitation, while Technical Impact: total aligns with the full CIA compromise in the CVSS vector. EPSS data was not provided, and the CVE is not listed in CISA KEV. The realistic risk is meaningful but not urgent for most enterprises - the attacker must already have shell access (e.g., via ADB, a compromised app with shell privileges, or physical device access), which significantly limits the attack surface compared to remote vulnerabilities. This is best characterized as a meaningful local-EoP issue most relevant to multi-user devices, kiosk deployments, MDM-managed fleets, and forensic/anti-tamper scenarios rather than a widespread exploitation priority. |
| Exploit ScenarioDerived | An attacker with shell-level access to an Android device - obtained via enabled ADB over USB on an unlocked workstation, a malicious app granted shell-equivalent capabilities, or hands-on access to a kiosk/shared device - invokes the vulnerable code path in the launcher process. Because the shell user holds excessive privileges, the attacker can execute arbitrary code in the launcher context, gaining elevated privileges on the device without prompting the user or requiring additional permissions. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged shell user to execute code within the launcher process due to over-privileged shell user permissions in multiple code locations. The flaw requires no user interaction and no additional execution privileges, enabling an attacker with shell-level access to gain elevated privileges. No public exploit identified at time of analysis, and SSVC indicates no observed exploitation, though technical impact is rated total.
RemediationAI
Patch available per vendor advisory - apply the Android security patch level published in the June 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-06-01), which addresses the over-privileged shell user condition in the launcher process. Device owners should update to the latest available OTA from their OEM that includes the 2026-06-01 (or later) security patch level; enterprise fleets should enforce minimum SPL via MDM compliance policies. As compensating controls until patches roll out, disable USB debugging (ADB) on production devices to remove the most common path to shell-level access, restrict physical device access in shared/kiosk deployments, and for MDM-managed fleets consider disabling developer options entirely via policy - note that this will block legitimate debugging workflows and field-support tooling.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Android launcher process - the system component responsible for the home screen and app management - where shell user accounts (typically the 'shell' UID used for ADB and developer access) hold permissions beyond what they require. This is a classic CWE-269 (Improper Privilege Management) weakness, where a process or user identity is granted capabilities that should be restricted to higher-trust contexts. The CPE entry cpe:2.3:a:google:android:*:*:*:*:*:*:*:* covers all Android variants, and the EUVD enumeration confirms the issue spans Android 14 through 16-qpr2, suggesting a long-standing over-permissive configuration rather than a regression introduced in a single release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android devices running versions 14 through 16-qpr2 are vulnerable to a privilege escalation vulnerability (CVE-2026-0091) that could allow malware to gain elevated system access without user intervention. The absence of a vendor-released patch creates an unmitigated security gap affecting all organizations deploying these Android versions in production environments. Immediate inventory and risk assessment are required to understand exposure across the mobile device fleet.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict shell access through MDM policies, implement application allowlisting via device management controls, enable full device encryption with secure boot verification, configure SELinux in enforcing mode with audit logging, deploy mobile threat defense solutions for runtime detection of privilege escalation attempts, and restrict third-party application installation through device policy.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB