# CVE-2026-0087: Google Android Framework privilege escalation in DomainVerificationService

Source: https://junglewise.ai/threats/cve-2026-0087-google-android-framework-privilege-escalation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-0087 · Severity: info · CVSS 7.8 · Published 2026-06-01

A logic error in the Android Framework allows a malicious application to hijack app links, which are the shortcuts that automatically open specific apps when a user clicks a web URL. By exploiting this flaw, an attacker could intercept sensitive data or redirect users to a fraudulent application without any user interaction. This could lead to an unauthorized elevation of privileges on the affected device.

Technologies: [Google Android Framework](https://junglewise.ai/threats/technologies/android-framework). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-0087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0087 being exploited in the wild.

**How severe is CVE-2026-0087?** Informational severity, with a CVSS score of 7.8, published 1 June 2026.

**Which products and versions are affected?** Google Android Framework 14, 15, 16, 16-qpr2.

**Is there a fix for CVE-2026-0087?** A patch was published on 2026-06-05: Security patch level 2026-06-05 or later addresses this issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0087 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-0087?** Check whether you run Google Android Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic error exists within the 'approvalLevelForDomainInternal' method of 'DomainVerificationService.java' in the Android Framework. This vulnerability allows a local attacker to hijack arbitrary app links (Android App Links), which are intended to associate specific web domains with verified applications. By manipulating the domain verification logic, a malicious app can intercept intents meant for other applications. Exploitation does not require additional execution privileges or user interaction. The issue affects Android versions 14, 15, 16, and 16-qpr2, and is addressed in the June 2026 security patch level.

## Affected products

- Google Android Framework 14, 15, 16, 16-qpr2

## Timeline

- 2026-06-01: disclosed: Vulnerability published in the June 2026 Android Security Bulletin.
- 2026-06-01: advisory
- 2026-06-05: patched: Security patch level 2026-06-05 or later addresses this issue.

## References

- [https://source.android.com/docs/security/bulletin/2026/2026-06-01](https://source.android.com/docs/security/bulletin/2026/2026-06-01)

## Related threats

- [Android Framework out-of-bounds exception in SipAddress telephony](https://junglewise.ai/threats/cve-2026-59623-in-compareteluris-of-sipaddress-cpp-there-is-a-possible-way-to)
- [Google Android Framework privilege escalation via incorrect bounds check](https://junglewise.ai/threats/cve-2026-28580-google-android-framework-privilege-escalation-via-incorrect)
- [Google Android Framework tapjacking in WindowManagerService](https://junglewise.ai/threats/cve-2026-28577-google-android-framework-tapjacking-in-windowmanagerservice)
- [Google Android Framework heap buffer overflow in LoadedArsc.cpp](https://junglewise.ai/threats/cve-2026-0100-google-android-framework-heap-buffer-overflow-in-loadedarsc-cpp)
- [Google Android Framework privilege escalation in launcher process](https://junglewise.ai/threats/cve-2026-0091-google-android-framework-privilege-escalation-in-launcher-process)