A local privilege escalation vulnerability in the Android ActivityStarter component could allow an attacker to gain elevated system permissions on affected devices.

This is an elevation of privilege vulnerability occurring in the executeRequest method of ActivityStarter.java. It functions as a confused deputy attack, which allows an attacker to launch activities with unauthorized privileges, provided the user interacts with the malicious trigger.

The vulnerability carries a CVSS score of 7.8, indicating a high severity level that warrants prompt attention. Successful exploitation allows a local attacker to escalate privileges, potentially leading to full system compromise, unauthorized data access, and the bypass of critical security boundaries on the mobile device.

Immediate Action: Apply the March 2026 Android security updates provided by Google or your device manufacturer as soon as they become available.

Proactive Monitoring: Monitor device logs for unusual activity or unexpected application launches that deviate from normal user behavior patterns.

Compensating Controls: Ensure that users are educated to avoid interacting with untrusted or suspicious applications, as user interaction is a required component for the exploit to succeed.

Public Exploit Available: Unknown

Given the potential for complete system compromise, this vulnerability poses a significant risk to organizational mobility security. Administrators should prioritize the deployment of the March 2026 security patches across all managed Android devices to prevent local privilege escalation.