A high-severity vulnerability in the Android CompanionDeviceManagerService allows local attackers to escalate privileges and gain unauthorized control over the device.

The vulnerability is a confused deputy flaw located within the onStart method of CompanionDeviceManagerService.java, allowing an authenticated local user to perform unauthorized actions with elevated privileges.

Successful exploitation of this flaw grants a local attacker full control over the affected device, potentially leading to total system compromise, data theft, and the bypass of security restrictions. With a CVSS score of 7.8, the vulnerability represents a significant risk to organizational data integrity and device security, particularly in environments where mobile devices are used to access sensitive corporate resources.

Immediate Action: Apply the March 2026 Android security updates provided by Google to all affected devices immediately.

Proactive Monitoring: Review system logs for unusual service execution patterns or unauthorized attempts to access sensitive device functions.

Compensating Controls: Enforce strict device management policies and restrict the installation of untrusted applications that could serve as an initial vector for local privilege escalation.

Public Exploit Available: Unknown

Given the severity of this elevation of privilege vulnerability, organizations should prioritize the deployment of the March 2026 security bulletin across all supported Android 16 deployments. Prompt application of vendor-supplied patches is essential to prevent local actors from gaining unauthorized administrative control over corporate mobile assets.