Executive brief
Android's framework contains a vulnerability in widget configuration that allows a malicious app to gain unauthorized access to files and resources belonging to other apps on the device. An attacker can exploit this without any special permissions or user interaction, leading to unauthorized access to sensitive data or capabilities of other applications.
Technical details
This is a confused deputy privilege escalation vulnerability in the onActivityResult method of AppWidgetConfigActivityProxy.java. The vulnerable component fails to properly validate URI permission grants, allowing an attacker to redirect permission grants intended for one app to be granted to another app. The attack is local and requires no additional execution privileges or user interaction. Successful exploitation results in local escalation of privilege and unauthorized URI permission access. Patches are available in Android 16-qpr2 and 17.
Affected products
- Google Android 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 and later addresses this issue