EUVD-2026-33808
GHSA-mw23-v9j7-5fv7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious low-privilege app
-
DeliveryInvoke framework via Shared.java
-
ExploitTrigger confused deputy in getCallingPackageName
-
ExecutionBypass activity start restrictions
-
PersistLaunch privileged activity
-
ImpactEscalate to higher-privileged context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Local code execution on the device is required: the attacker must already be running code as a low-privileged Android app (PR:L) on Android 14, 15, 16, or 16-qpr2, which in practice means tricking the user into installing a malicious or trojanized app, or chaining from a separate remote bug that yields app-context execution. No user interaction is needed once the malicious app is running (UI:N), no special device configuration is required, and the vulnerable code path is in the standard framework's getCallingPackageName in Shared.java - so any device on an affected, unpatched Android version is exposed. Exploitation is limited by the local-only attack vector and by Google Play Protect / sideloading restrictions that gate how malicious code reaches the device in the first place. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects local attack vector with low privileges and no user interaction, yielding a base score of 7.8 with full CIA impact - consistent with a typical Android local-EoP issue. SSVC contradicts treating this as urgent: Exploitation=none and Automatable=no, although Technical Impact=total aligns with the CVSS high impacts. There is no KEV listing, no public POC referenced, and EPSS data was not provided, so this should be treated as a real-but-not-emergent priority - patch in normal Android security update cadence rather than out-of-band. Note that scope is Unchanged (S:U), so the EoP stays within the Android security model boundary that the framework already enforces, but it still defeats activity start restrictions that gate sensitive UI flows. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app that holds only ordinary, low-risk permissions. In the background the app invokes the vulnerable Shared.java path so that the framework misidentifies the caller, allowing it to start a restricted activity it could not otherwise launch - for example a settings or permission-grant screen - and pivot to actions normally gated by stronger privilege checks, all without any user tap. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged app to bypass activity start restrictions through a confused deputy flaw in getCallingPackageName of Shared.java. No user interaction is required, and exploitation can yield high impact to confidentiality, integrity, and availability. No public exploit is identified at time of analysis, and SSVC indicates no observed exploitation in the wild.
RemediationAI
Apply the Android Security Bulletin update dated 2026-06-01 from https://source.android.com/docs/security/bulletin/2026/2026-06-01 - ensure devices report a Security Patch Level of 2026-06-01 or later on Android 14, 15, 16, and 16-qpr2 branches; exact fixed build numbers should be taken from that bulletin since they were not enumerated in the input data. There is no documented configuration workaround for a framework-level confused-deputy bug, so compensating controls are limited: restrict installation of untrusted apps (disable 'Install unknown apps' for non-essential sources, enforce Play Protect, and require managed-app catalogs via MDM for enterprise fleets) to reduce the population of low-privileged callers that could trigger the flaw, accepting the usability trade-off of blocking sideloaded apps. For high-risk users, defer installation of newly published third-party apps until the device SPL is updated.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lies in the Android framework's Shared.java helper, specifically the getCallingPackageName routine used to identify the calling app when brokering activity launches. CWE-441 (Unintended Proxy or Intermediary, i.e. 'confused deputy') describes exactly this pattern: a privileged component performs an action on behalf of a caller while misattributing the caller's identity, allowing a low-privileged app to leverage the framework's authority to launch activities it would otherwise be blocked from launching. Affected CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, covering the AOSP/Google Android platform itself rather than a specific OEM build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
CVE-2026-0098 is a HIGH severity privilege escalation in Google Android versions 14 through 16-qpr2, affecting potentially billions of mobile devices globally. A malicious application can bypass system activity restrictions through a confused deputy flaw, compromising confidentiality, integrity, and availability of affected devices without user interaction. Organizations must immediately assess mobile device inventory and implement compensating controls pending patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce MDM policies restricting untrusted app sources; (2) Implement application allowlisting; (3) Deploy behavioral monitoring to detect privilege escalation anomalies; (4) Segment Android devices from critical network resources; (5) Reduce app permissions using MDM policy enforcement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB