EUVD-2026-92599
GHSA-86g5-95j8-4f3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall low-privileged malicious app
-
DeliveryInvoke flawed isSystem() in WifiPermissionsUtil
-
ExploitBypass missing permission check
-
ExecutionEscape app sandbox
-
ImpactGain system-level privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a locally-present, low-privileged application on the device (PR:L, AV:L) that can reach the isSystem() code path in WifiPermissionsUtil.java; the missing permission check lets that app escape its sandbox and escalate to system privileges. No user interaction is required (UI:N) and no non-default configuration is indicated - the flaw is in the platform code itself. Limiting factors: the attacker must already achieve local code execution (e.g. a malicious or compromised app installed on the device), and only Android 17 is listed as affected, so devices on other versions or those that have applied the October 2026 patch level are not exposed. |
| Impact | This is a credible, high-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.8) indicates a locally-launched attack with low complexity, requiring only low privileges (i.e. an already-installed, low-privileged app), no user interaction, and a scope change - the hallmark of a sandbox escape where a malicious app breaks the Android app-sandbox boundary. CWE-862 (missing authorization/permission check) is consistent with the description's 'missing permission check' in isSystem(). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by severity and exploitability, not by observed exploitation. The signals are internally consistent (no CVSS-vs-description conflict), but note one gap: because this is a local app-to-system escalation, real-world risk depends on a malicious or compromised app already running on the device, which is the normal threat model for Android EoP bugs. Treat as a standard-to-urgent patch item in the Android monthly cadence rather than an emergency remote-RCE scenario. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app that holds only ordinary low-level privileges. The app invokes the flawed isSystem() path in WifiPermissionsUtil without triggering the missing permission check, escaping its sandbox to gain system-level privileges - all with no user interaction and low attack complexity (AV:L/AC:L). No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Local privilege escalation in Google Android 17 lets a locally installed, low-privileged application escape its sandbox and obtain system-level privileges by reaching the isSystem() routine in WifiPermissionsUtil.java, which fails to perform the required permission check (CWE-862). The flaw is rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting a changed-scope impact in which a compromised app in the application sandbox compromises the platform itself, with high confidentiality, integrity and availability effects and no user interaction required. An attacker must already have achieved local code execution on the device (for example through a malicious or trojanized app), and only Android 17 is listed as affected, so devices on other releases or on the October 2026 patch level are not exposed; no public exploit identified at time of analysis, and the issue is addressed through the Android Security Bulletin dated 2026-10-01.
RemediationAI
Apply the Android Security Bulletin for October 2026 (patch level 2026-10-01) from https://source.android.com/docs/security/bulletin/2026/2026-10-01, which is the vendor-released fix for CVE-2026-45524; patch availability is confirmed via the vendor advisory, and devices should be updated to a build that includes this security patch level. Because the defect is a missing permission check in platform code, there is no configuration toggle that removes the exposure - the patch is the only complete fix. Interim compensating controls reduce the likelihood of the prerequisite (a locally running low-privileged app) rather than the flaw itself: restrict installation to trusted sources and disable sideloading/untrusted installs (side effect: blocks legitimate enterprise and developer distribution workflows), keep Google Play Protect and app verification enabled, and monitor or block known-malicious or repackaged applications via mobile threat defense tooling (side effect: detection is heuristic and not a hard guarantee). Restricting Wi-Fi-related permissions for non-system apps offers limited benefit here since the missing check exists precisely so that callers do not need the normal permission grant. No vendor-released patch is available for unsupported or unpatched Android 17 builds beyond the October 2026 bulletin.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WifiPermissionsUtil is the Wi-Fi framework helper class in Android's Wi-Fi module that centralizes permission and caller-identity decisions for Wi-Fi APIs, and its isSystem() method is intended to determine whether the calling process holds system (UID 1000) identity. In the affected code path the method omits the authorization check entirely, which is a textbook instance of CWE-862 (Missing Authorization): a security-relevant decision is made without verifying that the caller actually satisfies the required privilege. Because the defect sits in platform/framework code rather than in an app, the vulnerability crosses a privilege boundary - the app sandbox is the vulnerable component while the impact lands on the Android system component, explaining the CVSS S:C (Changed) metric. The attack is local (AV:L) and requires only low privileges (PR:L), i.e. an app already running on the device, with no user interaction (UI:N) and no non-default configuration, so it functions as a sandbox escape leading to local escalation of privilege. The associated CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* and EUVD record EUVD-2026-92599 both scope the exposure to Android 17.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local app-launched attack (AV:L), low complexity, requires a low-privileged app (PR:L), no UI; the sandbox escape crosses a trust boundary so S:C with full system compromise (C/I/A:H).
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 2
Executive ViewAI
Google Android 17 is affected by a high-severity local privilege escalation that allows a malicious app already installed on a device to gain system-level control, potentially exposing enterprise data and weakening mobile security protections. This matters to organizations with Android 17 devices, especially those permitting third-party or untrusted app installations, because a compromised device could bypass sandbox boundaries. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis, so leadership should prioritize inventory, user restrictions, and monitoring while awaiting the official Android update.
No vendor-released patch identified at time of analysis; interim mitigations include disabling sideloading and untrusted app installs, enforcing app allowlisting and mobile threat defense, restricting sensitive data and privileged applications on Android 17 devices, and monitoring for anomalous privilege escalation. Apply the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB