Executive brief
Android contains a file permission vulnerability in multiple system components that allows an unprivileged local attacker to read and write files without proper authorization. This could allow an app to access sensitive data or escalate its privileges to perform unauthorized actions on the device, without requiring user interaction or special permissions.
Technical details
This vulnerability is a confused deputy attack affecting multiple locations in the Android system, allowing read/write file access without proper permission validation. The root cause involves improper access control checks in system components where a privileged component is tricked into performing file operations on behalf of an unprivileged process. The attack vector is local with no special execution privileges required, and user interaction is not needed for exploitation. An attacker can escalate privileges by gaining unauthorized access to sensitive files or system resources. Security patches addressing this issue are available in AOSP versions 14 and later with the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched