EUVD-2026-78984
GHSA-gjhh-9vcv-f7xr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged malicious app
-
ExploitTrigger type confusion in vulnerable component
-
ExecutionObtain protected signatures via confused deputy
-
ImpactEscalate to higher-privilege context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Requires local code execution on the device, i.e. a malicious/unprivileged app already installed and running on the affected Android/Pixel build (AV:L). No authentication, elevated privileges, or user interaction is needed beyond running the malicious app (PR:N/UI:N). Limiting factors: the attacker must first get their app onto the device (sideloading or a malicious Play listing), and exploitation is bounded to the specific Android/Pixel versions addressed in the 2026-09-01 Pixel bulletin - exact vulnerable version range is not specified in the available data. |
| Impact | This is a genuine but moderate-priority local privilege-escalation issue, not a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U, base 8.4) describes an unprivileged local application that can obtain signatures via a confused-deputy/type-confusion flaw and escalate privileges with no user interaction - the PR:N is meaningful here because it distinguishes this bug from the many sibling Android EoPs that require pre-existing System privileges (PR:H). Corroborating signals all point to low real-world urgency: EPSS is 0.11% (2nd percentile), there is no CISA KEV listing and no known public exploit, and no SSVC data was supplied. The C:H/I:H/A:H impact set looks like generous Android-bulletin boilerplate - the described primary effect is obtaining signatures leading to EoP, which readily justifies confidentiality/integrity impact but not obviously full availability impact. Note also a CWE/description tension: the CWE is CWE-441 (Confused Deputy) while the text says 'type confusion' (normally CWE-843); the confused-deputy framing fits 'obtain signatures' but the mechanism label is worth verifying against the source. Overall: real local EoP worth patching in the normal Android cycle, but no evidence of active or imminent widespread exploitation. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app from a third-party source; running with no special permissions, the app abuses a type-confusion/confused-deputy condition to obtain signatures it should not be able to access. It leverages those signatures to escalate privileges on the device without any user interaction. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Local privilege escalation in Google Android and Pixel builds lets an already-installed, unprivileged app leverage a type-confusion flaw in multiple system files to obtain signature data it should not be able to reach, escalating to a higher-privileged context. The attack is purely local: per the CVSS vector (AV:L/PR:N/UI:N) no credentials, elevated privileges, or user interaction are required beyond getting a malicious app running on the device, though the attacker must first sideload or distribute that app through a store listing. Exploitation is not confirmed as active, no public exploit code has been identified, and the EPSS score is very low (0.11%, 2nd percentile), making this a genuine but moderate-priority local privilege-escalation issue rather than a mass-exploitation threat; vendor patches are addressed in the 2026-09-01 Pixel security bulletin.
RemediationAI
Primary fix: apply the vendor patch released with the September 2026 Pixel security bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01) - an over-the-air Android security update that addresses the affected kernel/platform components; no specific patch version string is provided in the available data, so treat the 2026-09-01 (or later) security patch level as the remediation target and confirm the device's patch level under Settings > About phone. Because exploitation requires an attacker to first get code running locally, the highest-value compensating controls operate on the app-installation surface: disable 'Install unknown apps'/sideloading per app and keep Google Play Protect enabled to reduce the chance a malicious app ever reaches the device, at the trade-off of inconveniencing developers and enterprise sideloading workflows; on managed fleets, enforce Play-only or allow-listed app installation via MDM/EMM policy, which blocks sideloaded droppers at the cost of restricting internal app distribution; and remove or block known-untrusted or test-signed applications from device builds used in sensitive contexts. Standard AOSP mitigations (app sandboxing, verified boot, SELinux enforcement, and the SELinux/seccomp hardening already present on hardened builds) limit post-exploitation reachability but do not close the confused-deputy path itself, and there is no patch-independent configuration toggle identified in the available data that fully removes the exposure on an unpatched build. Prioritize patching on devices where untrusted or sideloaded APKs are routinely installed; given the low EPSS score (0.11%, 2nd percentile) and the absence of confirmed active exploitation or public exploit code, this can be scheduled as a routine security-update cycle rather than an emergency response.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-56985 is classified under CWE-441 (Unintended Proxy or Intermediary, i.e. 'confused deputy') and is described as a type-confusion defect present in multiple files within Android platform/kernel code, reported by Google_Devices. The pattern is characteristic of a component that trusts a caller-identifying or signature-bearing object and, because of an incorrect type assumption across a shared parsing, serialization, or Binder/IPC boundary, treats attacker-controlled data as a trusted object - effectively letting a low-privileged app 'borrow' the authority of a privileged intermediary to obtain signatures. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* and the EUVD entry (EUVD-2026-78984, 'Android Android kernel') confirm the affected platform is Google's Android, with the fix landing in the AOSP/Pixel patch stream. This analysis follows the independent assessment vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, which agrees with the vendor's confidentiality and integrity impact (both High) but scores availability impact as Low rather than High - the practical consequence is that the flaw reliably exposes signature material and enables privilege escalation, while it is not assessed to reliably crash or destabilize the device. No elevation of privilege or authentication is needed once code is running locally, and no user interaction is required beyond launching the malicious app.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local unprivileged app, no UI (AV:L/AC:L/PR:N/UI:N); obtaining signatures and escalating gives C:H/I:H, but availability impact is not established by the description so A:L rather than A:H.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
4DescriptionCVE.org
In multiple files, there is a possible way to obtain signatures due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android and Pixel devices in the estate are affected by CVE-2026-56985 (CVSS 8.4, HIGH), a local privilege-escalation flaw that a malicious app already running on a handset could use to reach privileged system data it should not be able to access. Because exploitation requires an attacker to first get an app onto the device - via sideloading or a store listing - the realistic exposure sits with employees who install untrusted software on corporate-managed or BYOD phones, not with the general internet-facing attack surface. There is no evidence of active exploitation, no public exploit code, and the EPSS score is very low (0.1%, 2nd percentile), so leadership should treat this as a genuine but moderate-priority mobile hardening issue rather than an incident trigger.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict app installation to managed Google Play via Android Enterprise policies; disable sideloading and revoke 'install unknown apps' permissions; keep Google Play Protect enabled; isolate corporate data in a work profile with an approved-app allowlist; block or monitor untrusted store listings and third-party app sources; reduce the number of privileged or signature-level apps on managed devices; and inventory endpoints for indicators of malicious app installation until the 2026-09-01 Pixel security bulletin patches can be applied.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB