A critical local privilege escalation vulnerability in Google Android allows an attacker to bypass security controls and potentially gain full system access.

This vulnerability is a logic error located in the Settings.java file, specifically within the enableSystemPackageLPw function. An attacker can exploit this flaw to prevent location access and achieve local escalation of privilege, requiring no additional execution privileges or user interaction.

The ability for a local attacker to escalate privileges represents a severe threat to the integrity and confidentiality of the device. Successful exploitation could allow an attacker to bypass security restrictions, access sensitive user data, or gain unauthorized control over system functions, justifying the high CVSS score of 8.4.

Immediate Action: Apply the relevant security updates provided in the March 2026 Android Security Bulletin as soon as they become available for your specific device.

Proactive Monitoring: Monitor device logs for unusual system-level activities or unauthorized attempts to modify system settings or permissions.

Compensating Controls: Ensure that device-level security policies are strictly enforced and limit the installation of applications from untrusted sources to reduce the likelihood of malicious code execution.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to the Android ecosystem by allowing unauthorized privilege escalation. Administrators and end users should prioritize applying the March 2026 security patches immediately upon their release by Google to mitigate the risk of local exploitation.