7.8

CVE-2026-0099

In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Android Version 14.0
Google ≫ Android Version 15.0
Google ≫ Android Version 16.0 Update -
Google ≫ Android Version 16.0 Update qpr2_beta_1
Google ≫ Android Version 16.0 Update qpr2_beta_2
Google ≫ Android Version 16.0 Update qpr2_beta_3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.001
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-273 Improper Check for Dropped Privileges

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

https://source.android.com/docs/security/bulletin/2026/2026-06-01
Vendor Advisory