Executive brief
A vulnerability in the Android operating system could allow a background application to launch without user consent. This flaw could be used by a malicious app already on the device to gain higher-level system permissions or perform unauthorized actions. No user interaction is required for this to occur, potentially compromising the security of the device and its data.
Technical details
A logic error exists within the 'resumeConfigurationDispatch' method of 'ActivityRecord.java' in the Android Framework. This flaw enables a Background Application Launch (BAL), which can be leveraged to achieve local escalation of privilege (EoP). The attack requires no additional execution privileges and zero user interaction. The vulnerability specifically affects Android version 16-qpr2. A fix is available via the June 2026 Android Security Bulletin (patch level 2026-06-05).
Affected products
- Google Android 16-qpr2
Timeline
- 2026-06-01: disclosed: Vulnerability published in Android Security Bulletin
- 2026-06-05: patched: Security patch level 2026-06-05 or later addresses this issue