Executive brief
Android's telephony system contains a logic error in call handling code that allows attackers to execute arbitrary code with system-level privileges. An attacker can exploit this without needing special permissions or user interaction, potentially gaining complete control over an affected device and access to all user data and device functions.
Technical details
The vulnerability exists in the serviceClassExists method of InCallController.java, where a logic error in the code flow permits arbitrary code execution. The flaw can be exploited by a local attacker to escalate privileges beyond the app's intended sandbox without requiring additional execution privileges or user interaction. This is a privilege escalation (EoP) vulnerability affecting Android's Framework component. Patches have been released and are available in AOSP versions 14 through 17, with a security patch level of 2026-09-05 or later addressing the issue.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses the issue