Executive brief
RemoteViews is a system component that Android uses to display custom UI layouts from other applications (e.g., in widgets and notifications). A logic error allows attackers to bypass background activity launch restrictions, enabling privilege escalation. An attacker with local access could exploit this to launch activities with elevated privileges without user interaction or additional permissions.
Technical details
This vulnerability exists in multiple functions of RemoteViews.java due to a logic error that allows bypassing background activity launch restrictions. The vulnerability is classified as a local escalation of privilege (EoP) and requires no additional execution privileges for exploitation. No user interaction is required. An attacker can exploit this flaw to launch arbitrary activities in the background with elevated privileges, potentially compromising system integrity and user data. Patches are available for Android versions 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched