Executive brief
A vulnerability in Android's AppRestrictionsFragment component allows local attacks to read and write private files through a confused deputy flaw. An attacker can escalate privileges without requiring additional permissions or user interaction, potentially compromising sensitive application data and system integrity on affected Android devices.
Technical details
This vulnerability exists in the assertSafeToStartCustomActivity method of AppRestrictionsFragment.java and exploits a confused deputy condition to gain unauthorized read/write access to private files. The flaw allows local privilege escalation with no additional execution privileges required, and no user interaction is necessary for exploitation. The vulnerability affects multiple Android versions (14 through 17), and patches are available in the Android 2026-09-05 security patch level and later.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched