Executive brief
Android's core system components contain a race condition that can lead to a use-after-free memory flaw. An attacker can exploit this remotely to execute arbitrary code with system-level privileges, without requiring user interaction or special device permissions. This could give an attacker complete control over an affected Android device and access to all user data.
Technical details
A use-after-free vulnerability exists in multiple locations within Android's system components, triggered by a race condition. The flaw allows an attacker to manipulate memory timing to use an object after it has been freed, leading to remote code execution (RCE). No special privileges or user interaction are required for exploitation; a network-based attack is possible. The vulnerability affects Android versions 14 through 17. Security patches addressing this issue are available in the Android security patch level 2026-09-05 or later, with source code fixes available in the AOSP repository.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later