Google Android EUVD-2026-78968

Exploitation requires the attacker to already have local code execution on the device - i.e., a malicious or compromised app running on an affected Android/Pixel device that can reach the fingerprint TEE HAL (fpc_tee_hal.c) interface. No user interaction and no additional execution privileges are required (PR:N/UI:N), which makes it usable by any unprivileged app, but the AV:L constraint means it cannot be triggered remotely and is only a post-foothold escalation step. Limiting factors: affected device must ship the Fingerprint Cards TEE HAL, must be unpatched relative to the 2026-09-01 Pixel/Android security patch level, and the attacker must win the use-after-free race/grooming to achieve reliable escalation.

This is a genuine but moderate-priority local privilege escalation. The CVSS vector (AV:L/AC:L/PR:N/UI:N) confirms it is locally exploitable with low complexity, no privileges, and no user interaction - meaning any unprivileged app already running on the device can trigger it, which is the meaningful part of the 8.4 score. However, the C:H/I:H/A:H impact triad is Google's generous boilerplate; a use-after-free in a fingerprint TEE HAL more realistically yields code execution in a specific service context rather than full triad compromise. Exploitation signals argue AGAINST elevated urgency: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public POC. No SSVC decision data was provided. The AV:L network-vector limitation is the dominant risk-reducer - this is not remotely reachable and requires prior local code execution, so it is a chained/post-compromise escalation primitive rather than an initial-access threat.

A malicious or compromised low-privilege app installed on an affected Android/Pixel device invokes the fingerprint TEE HAL (fpc_tee_hal.c) in a crafted sequence that triggers the use-after-free logic error. By grooming the freed allocation, the attacker gains code execution in a higher-privileged context, escalating privileges without any user interaction. No public exploit code is identified at time of analysis.