Executive brief
The Android Framework contains a logic error that allows applications to launch activities in the background without proper authorization checks. An attacker with local access can exploit this to bypass security restrictions and gain elevated privileges on the device, potentially taking control of sensitive system functions or accessing protected data.
Technical details
The vulnerability exists in the areBackgroundActivityStartsAllowed method of BackgroundLaunchProcessController.java in the Android Framework. The flaw is a logic error in the permission check logic that fails to properly validate whether an application is authorized to start background activities. An attacker with User-level execution privileges can trigger this vulnerability locally without user interaction to escalate privileges and perform unauthorized activity launches. Patches are available in AOSP versions 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses the issue