Executive brief
A security vulnerability in the Android Framework could allow a malicious local application to gain elevated system privileges. This occurs because certain launcher processes are granted excessive permissions, potentially allowing an attacker to take control of core device functions. No user interaction is required for this exploit to succeed.
Technical details
This vulnerability is classified as an Elevation of Privilege (EoP) within the Android Framework component. The root cause is an over-privileged shell user configuration across multiple locations that allows for code execution within the launcher process. A local attacker can exploit this to escalate their privileges to a higher level without requiring any additional execution permissions or user interaction. The issue affects Android versions 14, 15, 16, and 16-qpr2. It is addressed in the June 2026 Android Security Bulletin with security patch level 2026-06-05.
Affected products
- Google Android Framework 14, 15, 16, 16-qpr2
Timeline
- 2026-06-01: disclosed: Vulnerability published in Android Security Bulletin and NVD.
- 2026-06-05: patched: Security patch level 2026-06-05 or later addresses this issue.