Android Settings EUVD-2026-92630

Exploitation requires an attacker-controlled process already running locally on the device with at least low privilege (CVSS PR:L) - typically a malicious or compromised installed application - which then abuses a specific permission-check flaw in the Android Settings component (a confused deputy, CWE-441) to have Settings perform a privileged operation on the caller's behalf. No user interaction is required (UI:N) and no additional execution privileges are needed, but the local-only vector (AV:L) means remote or network exploitation is NOT possible; the attacker must first achieve code execution on the device. Confirmed-affected builds are Android 14, 15, 16, and 16-qpr2; the sole advisory is the Android Automotive OS bulletin, so whether all Android variants or primarily AAOS deployments are exposed should be verified with Google.

This is a genuine but second-tier priority: a local privilege-escalation flaw in the Android Settings component arising from a confused-deputy pattern (CWE-441), where a more-privileged component acts on behalf of a lower-privileged caller. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) signals a local attack vector with low complexity, requiring some existing privilege (PR:L) but no user interaction, yielding total compromise of confidentiality, integrity, and availability on the device. These signals are internally consistent - local vector matches the 'local escalation of privilege' description, and PR:L matches the need for an already-installed low-privilege app. However, the real-world-exploitation signals point DOWN, not up: SSVC records Exploitation as 'none' and Automatable as 'no' (consistent with a local PE that cannot be worm-driven across a network), there is no CISA KEV listing, and no public exploit code was identified. SSVC Technical Impact of 'total' aligns with the high C/I/A. No EPSS score was provided, so the quantitative exploitation probability is UNKNOWN and could not be weighed. Net: high technical impact but gated behind local access and existing privilege, with no evidence of exploitation - treat as a routine high-severity patch-cycle item rather than an emergency. One data discrepancy to verify: the sole vendor reference is the Android Automotive OS (AAOS) October 2026 bulletin, yet the CPE and affected-version list describe general Android - confirm whether this affects all Android builds or primarily AAOS.

A malicious or compromised low-privilege app already installed on the device invokes the Settings component in a way that causes Settings (the 'deputy') to perform a privileged action on the attacker's behalf, bypassing a permission check. Because no user interaction is required and the local attack complexity is low, the app silently escalates to elevated privileges and gains full control over device data and functions. No public exploit code was identified at time of analysis, and SSVC records no observed exploitation.