Executive brief
Android's Framework component contains a logic error in ActivityStarter.java that allows unprivileged applications to launch activities in the background without restriction, bypassing normal permission controls. An attacker can exploit this to escalate privileges and execute code with elevated permissions on the device without user awareness or interaction.
Technical details
This is a privilege escalation (EoP) vulnerability in the Android Framework's ActivityStarter.java caused by a logic error in the executeRequest method. The vulnerability allows local attackers to launch background activities without proper permission validation, circumventing the platform's activity launch restrictions. No additional execution privileges or user interaction are required for exploitation. The affected component is the System Framework, and patches are available in Android 14, 15, 16, 16-qpr2, and 17 versions released on or after the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched