# CVE-2026-0018: Google Android Framework denial of service in AccessibilityManagerService

Source: https://junglewise.ai/threats/cve-2026-0018-google-android-framework-denial-of-service-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-0018 · Severity: info · CVSS 5.5 · Published 2026-06-01

A vulnerability in the Android operating system's accessibility services could allow a malicious application to cause a persistent crash or system instability. This issue affects the core component responsible for managing accessibility features for users with disabilities. If exploited, it could lead to a permanent denial of service on the device, requiring technical intervention to restore normal operation.

Technologies: [Google Android Framework](https://junglewise.ai/threats/technologies/android-framework). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-0018 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0018 being exploited in the wild.

**How severe is CVE-2026-0018?** Informational severity, with a CVSS score of 5.5, published 1 June 2026.

**Which products and versions are affected?** Google Android Framework 15, 16, 16-qpr2.

**Is there a fix for CVE-2026-0018?** A patch was published on 2026-06-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0018 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-0018?** Check whether you run Google Android Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in the Android Framework within the AccessibilityManagerService.java component. The flaw is caused by improper input validation across multiple functions within the service. A local attacker can exploit this without any special execution privileges or user interaction to trigger a persistent denial of service state. The vulnerability is addressed in the June 2026 Android Security Bulletin for AOSP versions 15, 16, and 16-qpr2. While the NVD entry lists the severity as 'info', the primary vendor (Android) has classified this as 'High' severity.

## Affected products

- Google Android Framework 15, 16, 16-qpr2

## Timeline

- 2026-06-01: disclosed
- 2026-06-01: advisory
- 2026-06-01: patched

## References

- [https://source.android.com/docs/security/bulletin/2026/2026-06-01](https://source.android.com/docs/security/bulletin/2026/2026-06-01)

## Related threats

- [Android Framework out-of-bounds exception in SipAddress telephony](https://junglewise.ai/threats/cve-2026-59623-in-compareteluris-of-sipaddress-cpp-there-is-a-possible-way-to)
- [Google Android Framework privilege escalation via incorrect bounds check](https://junglewise.ai/threats/cve-2026-28580-google-android-framework-privilege-escalation-via-incorrect)
- [Google Android Framework tapjacking in WindowManagerService](https://junglewise.ai/threats/cve-2026-28577-google-android-framework-tapjacking-in-windowmanagerservice)
- [Google Android Framework heap buffer overflow in LoadedArsc.cpp](https://junglewise.ai/threats/cve-2026-0100-google-android-framework-heap-buffer-overflow-in-loadedarsc-cpp)
- [Google Android Framework privilege escalation in launcher process](https://junglewise.ai/threats/cve-2026-0091-google-android-framework-privilege-escalation-in-launcher-process)