EUVD-2026-73986
GHSA-6jr7-6hjc-42r3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on target Android device
-
DeliveryApp runs in background with PR:L privileges
-
ExploitTrigger logic error in RemoteViews.java functions
-
ExecutionBypass background activity launch (BAL) restrictions
-
PersistLaunch privileged foreground activity
-
ImpactAchieve full local privilege escalation (C:H/I:H/A:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires a malicious Android application to be installed and running on the target device, granting basic user-level execution context (PR:L per CVSS vector). No user interaction is required after app installation. The vulnerability is locally scoped (AV:L) - remote unauthenticated network exploitation is not possible. Exploitation is limited to devices running Android 14, 15, 16, 16-QPR2, or 17 that have not yet received the September 2026 security patch. No special configuration, feature flag, non-default setting, or specific Android component needs to be enabled - the flaw exists in default Android framework behavior across multiple RemoteViews.java functions. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the local nature of exploitation: an attacker must have a malicious app installed on the target device (PR:L), but once present, exploitation requires no user interaction and no elevated permissions. Full C/I/A impact reflects complete local privilege escalation capability. However, real-world exploitation probability is currently low: EPSS is 0.13% at the 3rd percentile, no KEV listing exists, no public POC has been identified, and SSVC rates current exploitation as 'none.' SSVC 'Automatable: no' aligns with the AV:L constraint - mass remote exploitation is impossible; each device must be individually compromised. SSVC 'Technical Impact: total' correctly reflects the severity once an attacker achieves local execution. This is a medium deployment priority: serious in targeted attack scenarios (e.g., malicious app stores, enterprise device compromise), but unlikely to see widespread opportunistic exploitation absent a public POC. |
| Exploit ScenarioDerived | An attacker distributes a malicious Android application - through a third-party app store, phishing, or enterprise supply chain - that a victim installs on their Android 14-17 device. The installed app, running in the background with standard user privileges, triggers the logic error across multiple RemoteViews.java functions to bypass BAL restrictions and launches a privileged foreground activity without user interaction. This yields full local privilege escalation with complete access to device confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Background activity launch bypass in Android's RemoteViews framework allows a locally installed malicious application with basic user privileges to escalate to full device compromise without user interaction. Multiple functions in RemoteViews.java contain a logic error (CWE-693) that defeats Android's background activity launch (BAL) protection mechanism, enabling unprivileged apps to launch foreground activities from background context. Affecting Android 14, 15, 16, 16-QPR2, and 17, this has broad attack surface across the Android ecosystem; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the Android security patch released in the September 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-09-01). The exact patched build identifier was not independently confirmed in available input data beyond the bulletin reference - OEM device manufacturers must integrate and distribute this patch, meaning availability will vary by device vendor and carrier. Enterprise administrators managing Android fleets via MDM/EMM solutions should enforce Android security patch level compliance policies requiring the September 2026 patch level and restrict sideloading of applications from untrusted sources to reduce exposure to malicious apps that would serve as the exploit delivery mechanism. No specific workarounds are documented for this vulnerability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RemoteViews is a core Android framework class enabling one process to inflate and render View layouts within another process's UI context - it underpins widgets, notifications, and inter-process UI delegation. Android's background activity launch (BAL) restrictions are a security mechanism designed to prevent apps running in the background from arbitrarily hijacking the foreground. CWE-693 (Protection Mechanism Failure) identifies the root cause: logic errors across multiple functions in RemoteViews.java cause the BAL enforcement to be incorrectly evaluated or bypassed, allowing a background-resident malicious app to invoke privileged activity launches. The vulnerability spans Android 14 through 17, including the Android 16-QPR2 quarterly platform release branch, per EUVD-2026-73986 affected version data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requires installed malicious app (AV:L/PR:L); no interaction after install; full device compromise once exploited; scope unchanged (S:U).
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
The Android RemoteViews framework (Android 14 through 17) contains a privilege escalation flaw allowing locally installed applications to achieve full device compromise without user interaction. Organizations with Android users face significant breach risk, particularly in BYOD environments, since no vendor patch is currently available.
Enforce Mobile Device Management policies restricting app installation to official app stores; disable developer options, USB debugging, and sideloading across all affected devices; implement application permission controls limiting sensitive access; conduct user security awareness training on app installation risks; maintain detailed inventory of all Android 14-17 devices for priority patching upon vendor release; deploy device integrity monitoring and anomaly detection systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB