Executive brief
A vulnerability in the Android Framework's device management service could allow a local attacker to gain elevated system privileges. This component is responsible for managing security policies on corporate and personal devices. An exploit could allow an unauthorized application to bypass security restrictions without any interaction from the user.
Technical details
An improper input validation vulnerability exists in the 'setGlobalProxy' method within 'DevicePolicyManagerService.java' of the Android Framework. This flaw can cause a synchronization failure (desync) in the persistence layer. A local attacker can exploit this to achieve elevation of privilege (EoP) without requiring additional execution privileges or user interaction. The issue affects Android versions 14, 15, 16, and 16-qpr2, and is addressed in the June 2026 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-06-01: disclosed: Published in the June 2026 Android Security Bulletin
- 2026-06-01: advisory
- 2026-06-05: patched: Security patch level 2026-06-05 or later addresses this issue