Android EUVD-2026-74028

Exploitation requires that attacker-controlled code already execute locally on the target Android device with at least low-privilege app context - for example, via a sideloaded or store-delivered malicious application. No special non-default system configuration is required; the missing permission check is present in the default Android framework across all affected versions. User interaction is not required after installation. Exploitation is bounded to the local device (AV:L - no network-based remote attack path). Devices running the September 2026 Android Security Patch Level or later are not vulnerable. The primary limiting factor is the requirement for local code execution: the attacker must first get an application installed on the device.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat profile: local access with minimal privileges is sufficient, attack complexity is low, and no user interaction is needed. The contained scope (S:U) limits the blast radius to the device itself, but the full CIA triad at High means a successful exploit yields complete device control. No EPSS data is available in the input, and neither a KEV listing nor public POC has been reported, placing this in the 'patched but unconfirmed in-the-wild' category. The breadth of affected versions - spanning Android 14 through 16-QPR2, which collectively represent the overwhelming majority of modern supported Android installations - significantly amplifies aggregate risk across large device fleets. The absence of user interaction and the low privilege bar mean that any installed malicious application, including those distributed through social engineering, can immediately attempt exploitation without further victim involvement.

A malicious Android application installed on a victim device - delivered via sideloading, a compromised third-party store, or social engineering - calls one of the unguarded SmsController functions directly. Because the permission check is absent, Android's framework processes the request as if the caller were authorized, allowing the app to escalate its effective privilege level and access SMS operations, sensitive data, or system capabilities restricted to privileged callers. No victim interaction is required beyond the initial app installation.