Android EUVD-2026-33806

Attacker must already have local code execution on the device as a low-privileged installed app (CVSS PR:L, AV:L) on Android 16 or Android 16-qpr2, and must be able to invoke or influence the Settings ForgetDeviceDialogFragment flow with an attacker-controlled application label. The user must reach and dismiss the misleading dialog for the privilege change to materialize; the CVE marks UI:N because no additional interaction beyond the standard dialog is required of the attacker's app, but the deception itself relies on the user tapping confirm. Limiting factors: requires a malicious app already installed, requires the target to have a forgettable companion device whose removal yields a privilege benefit, and is constrained to the affected Android 16 branches.

Signals are mixed and should be read carefully. CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H reflects the worst-case 'total' technical impact CISA SSVC also assigns, but the same SSVC record marks Exploitation as 'none' and Automatable as 'no', so this is not a mass-exploit candidate. There is a contradiction worth flagging: the CVE description says 'User interaction is not needed for exploitation' yet the vulnerability is fundamentally a UI deception that requires a human to tap 'Forget' on a misleading dialog - the UI:N likely refers to the attacking app not needing extra user interaction beyond the routine dialog the user already expects, not to fully silent exploitation. No EPSS score, no KEV listing, and no public PoC are reported. Realistic priority: moderate; worth patching in the normal Android monthly cycle but not an emergency.

A user installs a low-privileged malicious app (for example, a free utility from a third-party store). The app crafts an application label that mimics a trusted companion-device manager and triggers the ForgetDeviceDialogFragment so the user, believing they are confirming a benign action, taps through and unpairs a security-relevant companion device such as a smartwatch trust agent or an enterprise-managed peripheral, removing the trust binding the attacker wants gone. No public PoC is identified.