Android Xr
Monthly
Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. No public exploit identified at time of analysis; this is a Google/Android XR platform issue tracked in the September 2026 Android XR security bulletin.
Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addInputMethodListener, allowing an app or local context to register input method listeners without the authorization the IME subsystem normally requires. The flaw needs no user interaction and no additional execution privileges, and is addressed in the June 2026 Android XR security bulletin; no public exploit identified at time of analysis.
Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. No public exploit identified at time of analysis; this is a Google/Android XR platform issue tracked in the September 2026 Android XR security bulletin.
Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addInputMethodListener, allowing an app or local context to register input method listeners without the authorization the IME subsystem normally requires. The flaw needs no user interaction and no additional execution privileges, and is addressed in the June 2026 Android XR security bulletin; no public exploit identified at time of analysis.