Executive brief
Android's ActivityTaskManagerService handles the launching of activities on Android devices. A permission bypass vulnerability allows a local attacker to escalate privileges without requiring additional permissions or user interaction, potentially gaining elevated access to the device.
Technical details
The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java and is caused by a confused deputy vulnerability. This allows an attacker to bypass permission checks and achieve local escalation of privilege (EoP). The attack is local in nature and requires no additional execution privileges or user interaction. Patches have been released to AOSP for Android versions 14, 15, 16, 16-qpr2 as indicated in the security bulletin.
Affected products
- Google Android 14, 15, 16, 16-qpr2
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched