EUVD-2026-78992
GHSA-6hg4-jgf3-q6jw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious low-priv app on device
-
DeliveryApp invokes Setup Wizard package-install path
-
ExploitMissing permission check bypassed
-
ExecutionAttacker package installed with elevated privileges
-
ImpactFull device compromise (C/I/A:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Requires a locally-present, low-privilege application on the device (PR:L) that can reach the Setup Wizard's package-install code path lacking the permission check (CWE-693). No user interaction is required (UI:N) once the malicious app runs, and no additional execution privileges are needed. Exploitation is LIMITED to local access (AV:L) - despite the description's 'remote' phrasing, the CVSS vector confirms this is not a network-remote attack; the attacker must already have code running on the target Android/Pixel device. |
| Impact | The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) describes a LOCAL, low-privilege escalation of privilege - not a remote attack. This directly CONFLICTS with the description's wording 'possible remote package install' and 'remote escalation of privilege.' This is a known Android Security Bulletin convention: Android labels 'remote' vulnerabilities as those not requiring physical/local proximity in a colloquial sense, but the authoritative CVSS AV:L confirms a locally-installed malicious app (already on the device) is the actual attack surface - verify with Google's bulletin before treating as network-remote. CWE-693 (Protection Mechanism Failure) matches the description's 'missing permission check' in the Setup Wizard. There is NO EPSS score, NO KEV listing, and NO POC provided, so exploitation is not confirmed as active or public. Realistically this is a locally-exploitable EoP requiring a malicious app to already be running - a meaningful but not internet-facing risk, typical of the monthly Android EoP patch stream rather than an emergency. The 7.8 score is driven by full C/I/A:H impact (arbitrary package install = system-level compromise), tempered by the AV:L/PR:L prerequisites. |
| Exploit ScenarioDerived | A user installs a malicious low-privilege app from a third-party source. The app abuses the Setup Wizard's missing permission check to silently install an attacker-supplied package with elevated privileges, requiring no user interaction. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Privilege escalation in the Android Setup Wizard (Google Android, fixed in the September 2026 Pixel bulletin) lets a locally-running, low-privilege app trigger a package installation because the Setup Wizard's install code path performs a missing permission check. Per the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, exploitation requires code already executing on the device under a low-privileged context, needs no user interaction and no additional execution privileges, and yields high confidentiality and integrity impact in a local attack. Despite the advisory's 'remote package install' phrasing, the CVSS vector confirms this is not a network-reachable attack, and no public exploit has been identified at time of analysis.
RemediationAI
Apply the vendor fix by installing the Android security update containing the September 2026 Pixel bulletin fixes (Google Android Security Bulletin, Pixel, 2026-09-01, https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01); on Pixel hardware this arrives as the monthly over-the-air update, and Patch availability is confirmed via vendor advisory, though no specific build or fix version string is provided in the supplied data, so verify the device reports a security patch level of 2026-09-01 or later under Settings > About phone. Where the update cannot be deployed immediately, compensating controls must address the fact that the attacker requires a locally executing low-privilege app that can reach the Setup Wizard install path: restrict installation of untrusted applications by disabling 'Install unknown apps' per-source permission and enforcing Google Play Protect scanning (trade-off: breaks legitimate sideloading and enterprise app distribution), use MDM/Android Enterprise policies to allowlist approved packages or block sideloading entirely on managed fleets (trade-off: added administrative overhead and potential disruption to internal app deployment workflows), and reduce the local attack surface by removing or disabling unnecessary and untrusted applications on affected devices before patching (trade-off: manual effort and possible loss of functionality). These are interim mitigations only; because the defect is a missing permission check inside a privileged system component, no configuration change fully closes the flaw short of the vendor patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-693 (Protection Mechanism Failure) describes the root cause: a security control - specifically a permission check guarding the Setup Wizard's package-install routine - is either absent or ineffective, so a caller that should be rejected is allowed to invoke privileged package installation. Android's Setup Wizard runs in a highly privileged system context and handles initial device provisioning, which is why reaching its install path from a low-privilege application (PR:L in the CVSS vector) is significant; the flaw effectively lets that app piggyback on the Setup Wizard's authority to install arbitrary packages, escalating its own privileges (C:H/I:H, S:U). The AV:L metric in the provided vector is authoritative and constrains the attack model: the adversary must already have a locally-present application running on the affected Android device, and no user interaction (UI:N) is required once that app executes. The provided CPE (cpe:2.3:a:google:android:*:*) identifies the Google Android platform as the affected component, corroborated by the ENISA EUVD entry listing 'Android Android kernel' as the impacted platform for this Google Devices-reported issue.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local malicious app (AV:L, PR:L) abuses a missing permission check with no interaction (UI:N); arbitrary privileged package install yields full C/I/A impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
4DescriptionCVE.org
In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
A high-severity privilege-escalation flaw in the Google Android Setup Wizard (CVE-2026-57012, CVSS 7.8) could let a low-privileged local app trigger package installation without user interaction on affected Android devices. For leadership, the concern is managed and BYOD Android fleets-especially Pixel devices-where unauthorized package installation could undermine device integrity and data confidentiality; no public exploit has been identified at time of analysis, and no vendor-released patch is identified at time of analysis, with a fix referenced for the September 2026 Pixel bulletin.
No vendor-released patch identified at time of analysis; vendor fix referenced for September 2026 Pixel bulletin. Interim mitigations: enforce MDM/EMM restrictions on app installation sources, disable sideloading/unknown sources, apply application allowlisting, enable Google Play Protect/mobile threat defense, monitor for anomalous package-install events, and reduce unnecessary low-privilege apps on affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB