Executive brief
Android's GameManagerService contains a vulnerability in XML parsing that can be exploited to exhaust system resources and cause a permanent denial of service. An attacker with local access can trigger this issue without elevated privileges, potentially rendering the device unresponsive or forcing a restart. This impacts any Android device running vulnerable versions.
Technical details
The vulnerability exists in the parseInterventionFromXml method of GameManagerService.java and is classified as a denial-of-service attack exploitable through resource exhaustion. The flaw allows an attacker with local access to craft malicious XML input that triggers excessive resource consumption, leading to permanent DoS conditions. No elevated execution privileges or user interaction are required for exploitation. The Android security bulletin indicates patches are available in AOSP versions 14, 15, 16, 16-qpr2, and 17 with security patch level 2026-09-05 or later.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses the issue