Executive brief
Android's Framework component contains a flaw in how it validates user input when launching intents (a core mechanism apps use to communicate with each other). An attacker can exploit this to launch arbitrary intents without proper authorization, potentially escalating their privileges to perform unauthorized actions on a device. User interaction is required to trigger the vulnerability.
Technical details
The vulnerability exists in the initAppLinkTypeAndIntent method of ChannelImpl.java, where insufficient input validation allows an attacker to craft and launch arbitrary intents. This is a privilege escalation (EoP) vulnerability in the Android Framework component that can be triggered locally without additional execution privileges, though user interaction is required. The flaw permits an attacker to bypass intent-based access controls and execute privileged actions. Google released patches addressing this issue in AOSP versions 14, 15, 16, 16-qpr2, and 17, with a security patch level of 2026-09-05 or later addressing the vulnerability.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue