Android EUVD-2026-92608

Exploitation requires a local foothold on the device - the attacker must already be running code as a low-privilege app (PR:L), consistent with the standard Android malicious-app threat model. The flaw is a confused-deputy permission bypass in the dialInternal code path 'in multiple locations', meaning a privileged deputy component can be induced to perform a permission-protected action on behalf of an app that lacks that permission. Limiting factors: there is NO remote attack surface (AV:L), so the attacker must get code onto the device first (e.g., via a sideloaded or Play-delivered malicious app); however, NO user interaction is needed once the app runs (UI:N) and attack complexity is low (AC:L). Exploitation is bounded to affected Android versions 14 through 17 (including 16-qpr2); patched builds per the October 2026 Android Security Bulletin are not vulnerable.

This is a credible but not emergency-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a low-complexity attack requiring local access and existing low-level privileges (an installed/running app context), with no user interaction and total impact to confidentiality, integrity, and availability within the unchanged scope. All exploitation-likelihood signals point LOW: no EPSS score was provided, the CVE is NOT in CISA KEV, no public POC is referenced, and CISA SSVC explicitly records Exploitation: none and Automatable: no. These are consistent with each other - the only signal pulling upward is SSVC Technical Impact: total, which aligns with the C:H/I:H/A:H impact metrics. Net: a high-impact-if-exploited but currently non-exploited, non-automatable local flaw. Because exploitation requires a local foothold (a malicious or compromised app) and cannot be triggered remotely, real-world risk is meaningfully lower than the 7.8 score suggests in isolation; it is a patch-in-normal-cycle Android monthly-bulletin issue rather than a drop-everything item. EPSS data is absent, so probabilistic exploitation cannot be quantified - this is a data gap, not a low score.

A user installs a malicious or compromised low-privilege Android app. The app invokes the vulnerable dialInternal path, abusing a confused-deputy condition so a more-privileged system component performs a permission-gated action on the attacker's behalf, bypassing the permission check. No user interaction is required. No public exploit code has been identified at the time of analysis.