Executive brief
Android devices contain a Wi-Fi network suggestion system used by the operating system to recommend and manage available networks. A flaw in this component allows a local attacker to exhaust system resources and cause a persistent denial of service, preventing the device from functioning properly. No special permissions or user interaction are required to trigger the attack.
Technical details
A resource exhaustion vulnerability exists in the add() method of WifiNetworkSuggestionsManager.java in Android's Framework component. The vulnerability allows an attacker with local access to the device to repeatedly invoke the method in a way that exhausts memory or other system resources, leading to persistent denial of service. No additional execution privileges or user interaction are required for exploitation. The vulnerability affects Android versions 14 through 17 and has been patched in security patch level 2026-09-05 or later. Patches have been released to the Android Open Source Project (AOSP) repository.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched