MediaTek Power HAL EUVD-2026-72201

Exploitation requires that the attacker has already obtained Android System privilege on a device powered by one of the 40+ affected MediaTek chipsets. System privilege is a high baseline - above normal app privilege but below kernel/root - typically reachable only through a separate prior exploit (e.g., a chained vulnerability or a malicious system-level app installed with elevated permissions). No user interaction is required once System privilege is held. The vulnerability is inherently local (AV:L): remote exploitation is not possible without a prior local or remote access step to gain System-level foothold. Default Android security model (app sandboxing, SELinux) limits attacker reach to System privilege as a prerequisite.

The CVSS vector (AV:L/AC:L/PR:H/UI:N) correctly captures the prerequisite that an attacker must already hold System privilege - a significant barrier that constrains real-world exploitability. Despite SSVC rating technical impact as 'total', the exploitation status is 'none' and automatable is 'no', indicating this is not a walk-up exploit. CVSS base score of 6.7 is appropriate given the PR:H requirement. EPSS data is not provided, but the absence of public exploit code and KEV listing supports treating this as a lower-urgency patch cycle item rather than an emergency; even a mid-sized municipal IT team in gliwice managing a fleet of MediaTek-based Android kiosks should prioritize this within their normal monthly patching cadence rather than as a critical out-of-band response. The breadth of affected chipsets is notable - attackers targeting a specific MediaTek-based device ecosystem (e.g., budget Android handsets) who have already achieved initial System access could use this to establish deeper persistence at higher privilege.

An attacker who has compromised a malicious application granted System-level privilege (e.g., via a prior exploit chain or supply-chain compromise of a system app) crafts a sequence of Power HAL interactions that trigger the type confusion, corrupting internal HAL data structures. This allows the attacker to pivot from System privilege to a higher privilege tier - potentially kernel-level - enabling persistent device compromise, keylogging, or extraction of protected credentials without further user interaction.