Executive brief
A vulnerability in the Android operating system could allow an attacker to bypass parental or administrative controls. By exploiting a flaw in the component responsible for managing device supervision, an attacker could delete supervision data without authorization. This could lead to an unauthorized elevation of privileges on the device, potentially allowing restricted users to bypass security policies.
Technical details
A vulnerability exists in the 'onCreate' method of 'DisableSupervisionActivity.kt' within the Android System component. The flaw is caused by a missing null check, which can be triggered to delete supervision data. A local attacker can exploit this to achieve escalation of privilege (EoP) without requiring additional execution privileges or user interaction. The issue is addressed in the June 2026 Android Security Bulletin for AOSP version 16-qpr2.
Affected products
- Google Android 16-qpr2
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory
- 2026-06-01: patched