EUVD-2026-78995
GHSA-rcx4-x4hm-jrrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryCraft intent to DreamPickerReceiver
-
ExploitTrigger confused-deputy permission bypass
-
ExecutionCoerce System component to act
-
ImpactEscalate to System privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Requires the attacker to already have local code execution on the device - a malicious or compromised app installed and running - that can send intents to the DreamPickerReceiver component (the screensaver/Daydream picker). Exploitation is fully local (AV:L) with no user interaction (UI:N), so no phishing or click is required once the app is present. Limiting factors: no remote/network reach whatsoever, dependency on the confused-deputy permission-bypass path in DreamPickerReceiver.kt, and applicability to affected Android/Pixel builds per the September 2026 bulletin; devices patched with the 2026-09-01 security level are not exposed. |
| Impact | This is a genuine but locally-scoped Android privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) is entirely local: an attacker needs code already running on the device (a malicious/low-privileged app) to abuse the confused-deputy flaw in DreamPickerReceiver.kt and reach System-level impact - there is no remote or network exposure. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is not evidence of active or widespread exploitation; it reads as a routine monthly Android/Pixel-bulletin EoP hardening fix. NOTE A CONFLICT: the description states 'System execution privileges needed,' which would normally imply high privilege (PR:H) and a lower score, yet the assigned vector uses PR:L. The confused-deputy pattern (a low-privileged app tricking a System-privileged component) is consistent with PR:L, but the phrasing is ambiguous and should be verified against the Android/Pixel bulletin. Real-world priority is moderate: it is a valuable link in a local exploit chain (e.g., after a malicious app is installed) rather than a remotely weaponizable critical flaw. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app from a third-party source. The app sends crafted intents to the vulnerable DreamPickerReceiver, which - acting as a confused deputy - performs a privileged action on the attacker's behalf, bypassing a permission check and letting the app escalate to System execution privileges with no user interaction. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
RemediationAI
Apply the vendor fix by updating affected Pixel/Android devices to the security patch level published in the September 2026 Pixel bulletin (2026-09-01), available via over-the-air system update; this is the only complete remediation and removes the confused-deputy path in DreamPickerReceiver.kt. Where immediate update is not possible, note that the exploit prerequisite is a locally executing malicious app, so the most effective compensating controls target app installation: enforce an MDM/enterprise app allowlist or rigorous Play Protect scanning and disable 'Install unknown apps' for all users (trade-off: blocks legitimate sideloading and some enterprise internal apps), and remove unnecessary or untrusted apps from high-value devices. Because the attack requires no user interaction, user-awareness training and phishing defenses provide no mitigation here, and there are no known network-side controls given the strictly local (AV:L) attack vector - the practical residual risk is limited to devices that cannot be patched, for which de-provisioning or isolating the device from sensitive data is the remaining option. Verify effectiveness by confirming the device security patch level shows 2026-09-01 or later, using the vendor advisory at https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DreamPickerReceiver is an Android broadcast/intent receiver that handles requests related to the Daydream screensaver picker. As a component that can be addressed by other apps on the device, it sits on the Android Binder/IPC trust boundary between untrusted application processes and privileged framework code running in system_server. CWE-441 (Unintended Proxy or Intermediary, i.e. a confused deputy) describes the root cause here: the receiver fails to sufficiently verify that the calling UID or package is authorized for the operation it performs, so a lower-privileged app can induce the higher-privileged receiver to act on its behalf and effectively inherit System-level execution context. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects that a low-privileged local actor can achieve full compromise of confidentiality, integrity, and availability of the vulnerable component's security scope with no user interaction and no network vector. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* indicates the flaw is tracked against the Android platform broadly, with the fix distributed through Google's Pixel/Android monthly bulletin rather than a standalone application release.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local malicious app abuses a System-privileged deputy (AV:L, PR:L, UI:N); escalation to System yields full C/I/A impact, no scope change (S:U).
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android/Pixel devices with security patch levels prior to 2026-09-01 are affected by CVE-2026-57042, a high-severity local privilege escalation that could allow a malicious or compromised app to reach System-level privileges on the device. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, but the flaw still creates meaningful enterprise risk for organizations that permit untrusted or sideloaded apps on mobile endpoints. Leadership should prioritize device inventory, app-install restrictions, and readiness to apply the 2026-09-01 Android/Pixel security patch level to protect corporate data and device integrity.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing managed Google Play or allowlist-only app installation, blocking sideloading and unknown sources, disabling developer options, restricting local code execution through EMM/MDM policies, monitoring for suspicious or compromised apps, and applying the 2026-09-01 Android/Pixel security update as soon as it is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB