Executive brief
Android's HostEmulationManager contains a logic error that permits a malicious local application to launch arbitrary background activities with elevated privileges without user interaction. This vulnerability could allow an attacker to gain system-level permissions and compromise device security, access sensitive data, or enable further exploitation.
Technical details
The vulnerability exists in multiple functions of HostEmulationManager.java due to a logic error in the code path that validates or restricts background activity launches. The flaw is a local privilege escalation (EoP) affecting the Android Framework component and requires no additional execution privileges or user interaction to exploit. An attacker with local app access can trigger the vulnerable code to bypass permission checks and launch arbitrary background activities with escalated privileges. Patches are available in Android security updates with patch level 2026-09-05 or later.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17 (patched in 2026-09-05 or later)
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched