Executive brief
Android's system framework contains a flaw in permission checking logic that could allow an attacker with local access to bypass intended access controls and read sensitive information. The vulnerability involves how the system validates permissions when apps request access to protected resources, potentially allowing one app to access data it shouldn't be allowed to see. No special privileges or user interaction are required to exploit this issue.
Technical details
The vulnerability is a confused deputy vulnerability in the screenArgsForPermissionCheckIfAny function across multiple locations in Android's Framework component. The flaw occurs in the permission validation logic, where insufficient checks on caller identity allow a local attacker to escalate their access to information they are not authorized to view. The attack is local in nature and requires no additional execution privileges or user interaction. The vulnerability leads to information disclosure of local data. Patches are available in Android security patch level 2026-09-05 or later, with fixes integrated into AOSP versions 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched