Executive brief
Android's StorageManagerService contains a flaw in how it constructs a PendingIntent used to launch the storage management interface. An attacker can exploit this to redirect the intent to arbitrary activities, gaining elevated privileges on the device. This could allow malicious apps to access sensitive system features or data without proper authorization, though user interaction is required to complete the exploit.
Technical details
The vulnerability is a local privilege escalation caused by an unsafe PendingIntent in the getManageSpaceActivityIntent method of StorageManagerService.java. The flaw allows a "LaunchAnyWhere" attack chain in which an attacker-controlled app can intercept or redirect the PendingIntent to launch arbitrary activities with elevated privileges. The attack requires local access and user interaction (the user must trigger an action that invokes the vulnerable intent), but no special execution privileges are needed to set up the malicious component. Patches are available in AOSP versions 14, 15, 16, 16-qpr2, and 17, with a security patch level of 2026-09-05 or later required to address this issue.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later