Android Kernel EUVD-2026-78978

Exploitation requires the attacker to already possess local System execution privileges on the device (PR:H, AV:L) - the flaw is a privilege-escalation logic error reachable only from that context, not a remote or unprivileged entry point. No user interaction is required (UI:N). What limits it: the high pre-existing privilege requirement means it is only useful as a secondary escalation step after an initial System-level compromise, and the scope is effectively Google Pixel / Android devices addressed by the 2026-09-01 Pixel bulletin. The description names no specific feature or configuration, so no non-default setting is known to be required.

This is a genuinely low real-world priority despite its 'Medium' 6.7 CVSS score. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U) makes the gating factor explicit: exploitation is LOCAL and requires PR:H - the description itself states 'System execution privileges needed.' An attacker who already holds System privileges on an Android/Pixel device has little left to gain, so the C:H/I:H/A:H impact rating is generous and the net severity is modest. Exploitation signals reinforce low urgency: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public POC is identified. No SSVC decision data was supplied. The signals are internally consistent - a local, high-privilege, no-active-exploitation logic bug - with no network-vs-local contradiction to flag. The main caveat is that the description is boilerplate ('logic error in multiple locations') and identifies no specific component, so the exact attack surface cannot be verified from the input alone.

Malicious or compromised code already running with System execution privileges on a Pixel/Android device invokes an affected code path whose logic error permits crossing into a higher-privileged context. No user interaction is required. No public exploit code has been identified, so any attack would presently require original vulnerability research.