Executive brief
Android's phone interface component improperly validates permissions when sending USSD (Unstructured Supplementary Service Data) requests, allowing a local attacker to make unauthorized telecom commands. An attacker could exploit this to send USSD codes that charge the user, reveal account information, or trigger carrier-specific actions without user consent or required permissions.
Technical details
A logic error in PhoneInterfaceManager.java's handleUssdRequest method fails to properly enforce permission checks before processing USSD requests. The vulnerable code path allows local applications to bypass the required SEND_USSD or similar permission checks through a permission validation bypass. This is a local privilege escalation vulnerability requiring no additional execution privileges and no user interaction. An attacker with access to the device (e.g., a malicious app installed by the user or a compromised system app) can invoke the vulnerable code path to send arbitrary USSD requests. Patches are available in AOSP Android 14 and later versions as of the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later