Google Android EUVD-2026-92629

Exploitation requires a local foothold: an attacker-controlled app already installed and running on the affected device (Android 14, 15, or 16-qpr2), consistent with AV:L/PR:L. The flaw is a logic error in DeviceAdminAppsPreferenceController.updateState that bypasses a permission check within the device-admin apps preference flow, so the attacker must be able to reach that Settings code path. Limiting factors that reduce real-world risk: no remote network vector (must have code execution on-device first), and per CISA SSVC the flaw is not automatable (cannot be reliably mass-exploited). Mitigating that risk slightly is that no user interaction is required (UI:N), so once the malicious app is present it can act silently.

This is a credible but not emergency-tier issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege escalation requiring an already-present low-privileged context (a malicious or compromised app) on the device - not a remotely reachable flaw. CISA SSVC reinforces a measured priority: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited/wormed), but Technical Impact=total (full compromise of the component's confidentiality, integrity, and availability once triggered). There is no CISA KEV listing and no POC indicator in the provided data, and no EPSS score was supplied, so exploitation probability cannot be quantified from this input. All signals are internally consistent: a logic error producing a permission bypass is exactly the kind of local EoP that scores high on impact yet depends on a foothold and is hard to automate at scale. Net: treat as a standard high-severity Android monthly-bulletin patch - important for devices processing untrusted apps, but not evidence of active, widespread attack. No conflicting signals were detected in the data.

A user installs a malicious or compromised low-privilege app on an affected Android/AAOS device. The app abuses the logic error in DeviceAdminAppsPreferenceController.updateState to bypass a permission check, gaining elevated privileges without any user interaction or additional execution rights. No public exploit code was identified at time of analysis.