EUVD-2026-79150
GHSA-67jr-3r4p-2h34
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local-only access requiring pre-existing System privileges (PR:H), no user interaction, and confidentiality-only impact with no integrity or availability loss.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local information disclosure in Google Android's CPM component allows a caller holding System-level execution privileges to read protected data by abusing a confused deputy (CWE-441) that performs an action on behalf of a less privileged requester without re-validating the caller's authority. Only locally positioned code already running with System privileges on an affected Android build can trigger the flaw, and no user interaction is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on the affected Android build running with System execution privileges (per the CVSS PR:H metric) - no user interaction is required (UI:N), and there is no network exposure (AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The scoring profile is internally consistent but materially dampens real-world urgency: AV:L means no network reachability, PR:H means the attacker must already hold System execution privileges, and UI:N means no victim interaction is needed once that foothold exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix from the September 2026 Android/Pixel security bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 and bring devices up to the listed security patch level or later - this is the only complete remediation, and no exact fix build number is exposed in the supplied data so the bulletin must be consulted for the precise patch identifier. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today