EUVD-2026-73963
GHSA-3f78-gj22-rhmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconInstall malicious Android app
-
DeliveryLure user to interact with crafted deep-link or UI element
-
ExploitTrigger initAppLinkTypeAndIntent with attacker-controlled input
-
InstallBypass intent validation in ChannelImpl.java
-
C2Launch arbitrary intent targeting privileged component
-
ExecuteAccess protected data or functionality
-
ImpactAchieve local privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires three concrete prerequisites: (1) a malicious application must be installed on the target Android device running Android 14 through 17 or 16-QPR2; (2) the attacking app must have low-level user privileges (PR:L - a standard installed app context, not requiring system or root access); (3) the user must actively interact with a mechanism that triggers the initAppLinkTypeAndIntent code path (UI:R - e.g., tapping a crafted link, button, or deep-link within the malicious app). Exploitation is limited to the local device; no network access or remote delivery path applies. The user-interaction requirement is a genuine barrier: the attack cannot be silently automated without the victim's participation. |
| Impact | CVSS 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a realistic threat model: the attack is local, requires a low-privileged installed app, and demands user interaction (e.g., the victim must tap a crafted link or trigger an in-app action). These constraints substantially reduce practical risk versus a remote no-interaction vulnerability. SSVC corroborates this: Exploitation=none, Automatable=no, Technical Impact=total - meaning if exploitation occurs the impact is severe, but the automation barrier and lack of observed exploitation make this a medium-priority patching target. EPSS of 0.11% at the 2nd percentile signals low community-observed exploitation interest. No KEV listing and no public POC are reported. The CVSS C:H/I:H/A:H impact triad reflects that successful exploitation can fully compromise device state at the user level, but the local+UI:R gate limits real-world attacker surface to scenarios involving malicious apps installed on the device. |
| Exploit ScenarioDerived | An attacker distributes a malicious Android application (sideloaded or via a third-party source) that, when the user interacts with a crafted in-app element or deep link, calls into the vulnerable initAppLinkTypeAndIntent code path with attacker-controlled intent parameters. The insufficient validation allows the malicious app to redirect the launched intent to a privileged system component, gaining access to protected functionality or data and achieving local privilege escalation on Android 14-17. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.
RemediationAI
Apply the Android Security Patch Level (SPL) corresponding to the September 2026 Android Security Bulletin, available at https://source.android.com/docs/security/bulletin/2026/2026-09-01. Device OEMs must integrate and distribute this patch via system updates; end users should verify their device has received the relevant SPL. No vendor-documented workaround specific to this intent redirection path is available. As a compensating control where updates are delayed, organizations with enrolled Android devices under MDM can restrict sideloaded/unknown-source app installations, which reduces the attacker's ability to deliver the malicious app prerequisite for exploitation, though this does not eliminate risk from Play Store apps with malicious behavior.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in initAppLinkTypeAndIntent within ChannelImpl.java, an Android framework component responsible for resolving and constructing App Link intents used for deep-linking between applications. CWE-20 (Improper Input Validation) indicates the method fails to validate the intent target or parameters before launching, allowing an attacker-controlled input to redirect the intent to an arbitrary destination. Intent redirection on Android is a well-understood attack class: because intents can target unexported or privileged components, an attacker who can coerce the system into launching their chosen intent may access protected activities, services, or content providers - effectively bypassing Android's component isolation model. Affected CPE encompasses Android 14, 15, 16, 16-QPR2, and 17 as confirmed by the EUVD entry.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local attack surface with low-privilege installed app required (PR:L); user interaction gates exploitation (UI:R); full C/I/A impact reflects device-level privilege escalation.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Executive ViewAI
Android devices running versions 14 through 17 contain a local privilege escalation vulnerability in intent-handling that could allow an installed application to gain elevated permissions. No public exploit identified at time of analysis; however, the absence of a vendor patch combined with the privilege escalation vector requires organizations with Android deployments to implement defensive controls and establish monitoring for future patch availability.
No vendor-released patch identified at time of analysis. Implement interim mitigations: (1) Deploy mobile device management (MDM) controls to restrict third-party application installation; (2) enforce fine-grained app permission policies to limit scope of installed applications; (3) implement behavioral detection and monitoring for privilege escalation indicators; (4) restrict high-risk device usage for sensitive operations until patches are available; (5) maintain active monitoring of Android security bulletins and OEM advisories for availability of fixes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB