Executive brief
Android's system framework component contains a missing permission check in file-opening functionality that could allow local exposure of sensitive information without requiring elevated privileges or user interaction. An attacker with local access to an Android device could exploit this flaw to read files that should be restricted, potentially compromising user data or system security.
Technical details
This is an information disclosure vulnerability (CWE-200 / missing authorization) in the openFile method of AppFuseBridge.java within the Android Framework. The vulnerability stems from a missing permission check that should prevent unauthorized local file access. The attack vector is local; no network access is required. An attacker with local access (e.g., via an installed app or physical device access) can bypass the intended file access controls with no additional privileges. The impact is unauthorized disclosure of sensitive files. Patches are available in Android security patch level 2026-09-05 or later, with source code updates to AOSP branches 14 through 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Patches released in Android security patch level 2026-09-05 or later