Executive brief
Android's ClipboardService handles clipboard access across multiple user accounts on a device. A logic error in the user permission checking allows one user to access or manipulate clipboard data of other users, violating the system's multi-user isolation. An attacker with local device access can escalate privileges and access sensitive data from other users without their knowledge or consent.
Technical details
The vulnerability is an information disclosure (ID) issue in the setClipboardAccessNotificationsEnabledForUser method of ClipboardService.java. A logic error in the code fails to properly enforce multi-user isolation boundaries, allowing one user account to read or manipulate clipboard state belonging to another user account. The attack vector is local with no additional execution privileges or user interaction required. An attacker can directly invoke the vulnerable method to bypass user isolation and access sensitive clipboard data or settings from other user profiles on the same device. Patches are available in Android AOSP versions 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09: patched: Security patch level 2026-09-05 or later