Android EUVD-2026-73954

The attacker must have a malicious application installed and executing on the target device with at least standard user-level privileges (PR:L per CVSS); root or elevated system access is not required. The target device must have NFC payment capability and the Android payment framework active (standard on modern Android devices). No user interaction is required during exploitation once the malicious app is running. Exploitation is strictly local (AV:L) - remote unauthenticated exploitation is not possible. The attack is not automatable at scale per SSVC, confining realistic scenarios to targeted attacks or post-compromise lateral capability. No non-default configuration is required beyond standard NFC-enabled Android device operation.

The CVSS 7.8 High vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the key constraints: the attack is local-only, requiring the adversary to already have a malicious application executing on the device at standard user privilege. The C:H/I:H/A:H impact reflects the consequence of hijacking the payment default - payment credentials and transaction data routed through a rogue app. The SSVC 'Technical Impact: total' reinforces this, while 'Automatable: no' confirms the attack cannot be scripted for mass compromise. EPSS at 0.11% (2nd percentile) aligns with 'Exploitation: none' and the local-vector constraint, indicating no observed exploitation in the wild. The low EPSS relative to the 7.8 CVSS is expected here: local-only, no UI interaction required but still needs app installation by a user, which limits scale. Even a mid-sized municipal IT team in radom managing enterprise Android fleets should treat this as a standard patch-cycle priority rather than an emergency - the real risk materializes only in post-compromise or targeted insider scenarios, not remote mass exploitation. No KEV listing and no POC further temper urgency.

A malicious application installed on the victim's Android device - obtained via sideloading or a compromised app store listing - calls the PaymentDefaultDialog activity with a crafted intent, exploiting the confused deputy to invoke the privileged default-payment-app change without requiring elevated permissions. The dialog completes the operation, silently registering the attacker's app as the default NFC payment handler. All subsequent contactless payment transactions are routed through the rogue application, enabling interception of payment credentials or silent transaction fraud. No public exploit code has been identified.