Executive brief
A vulnerability in the Android operating system could allow a user to be misled into disconnecting or 'forgetting' a device due to a confusing user interface. This issue affects the dialog box used for managing connected devices and could be used to gain unauthorized elevated privileges on the device. While it requires local access, it does not require the user to perform any specific action to be exploited.
Technical details
An Elevation of Privilege (EoP) vulnerability exists in the 'getAppLabel' method of ForgetDeviceDialogFragment.java within the Android System component. The root cause is a misleading or insufficient user interface that can trick a user into forgetting a device. An attacker with local access could exploit this to achieve local escalation of privilege without needing additional execution permissions. According to the advisory, user interaction is not required for exploitation despite the UI-centric nature of the description. Patches are available in the June 2026 Android Security Bulletin for AOSP versions 16 and 16-qpr2.
Affected products
- Google Android 16, 16-qpr2
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory
- 2026-06-01: patched: Security patch levels of 2026-06-05 or later address this issue.