Executive brief
Android's core system component (ActivityManagerService) manages how apps communicate and launch each other through a mechanism called Intents. A logic error in the code allows malicious apps to bypass security checks and redirect Intents to unintended targets, enabling unauthorized privilege escalation without requiring special system permissions. An attacker can exploit this to gain elevated capabilities within Android's security sandbox.</brief> <parameter name="technical_details">This vulnerability is a local privilege escalation (EoP) affecting the Android Framework component, specifically in the addCreatorToken method of ActivityManagerService.java. The root cause is a logic error that permits Intent Redirection Bypass—attackers can redirect Intents to unintended recipients by circumventing validation checks. The attack is network-local and requires no additional execution privileges or user interaction. Successful exploitation allows an attacker to escalate privileges within the affected Android process. The vulnerability is addressed in AOSP versions 16, 16-qpr2, and 17, with patches available in the Android Security Bulletin dated 2026-09-01 (security patch level 2026-09-05 or later).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17 (affects 16, 16-qpr2, 17 per advisory)
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin
- 2026-09-05: patched: Addressed in security patch level 2026-09-05 or later