Executive brief
A vulnerability in the Android Framework could allow a malicious application already on the device to gain elevated system privileges. This issue is caused by a synchronization error when the system runs out of certain resources while handling media button commands. An attacker could exploit this to bypass security restrictions without any interaction from the user.
Technical details
A privilege escalation vulnerability exists in the getComponentName method of MediaButtonReceiverHolder.java within the Android Framework. The root cause is a desynchronization in persistence logic triggered by resource exhaustion (CWE-770/CWE-400). A local attacker with low privileges can exploit this flaw to achieve a local escalation of privilege (EoP) without requiring additional execution privileges or user interaction. The vulnerability affects Android versions 13, 14, 15, and 16, and has been addressed in the June 2026 Android Security Bulletin.
Affected products
- Google Android 13, 14, 15, 16
Timeline
- 2025-12-08: disclosed: Initial CVE publication date
- 2026-06-01: patched: Security bulletin and patch details released by Android