A critical local privilege escalation vulnerability in Google Android allows an attacker to bypass security restrictions and execute arbitrary activities as a privileged system component.

The flaw exists in the setupLayout method of PickActivity.java, where a confused deputy issue enables an attacker to start any activity as a DocumentsUI application, resulting in unauthorized privilege elevation.

The ability to escalate privileges locally poses a severe threat to the integrity and confidentiality of the mobile device environment. An attacker could potentially bypass sandbox restrictions to access sensitive user data, modify system configurations, or perform unauthorized actions, justifying the high CVSS score of 8.4.

Immediate Action: Review the Google Android Security Bulletin for March 2026 and apply the applicable security patches or firmware updates provided by your device manufacturer.

Proactive Monitoring: Monitor device logs for unusual activity related to the DocumentsUI package or unexpected application startup behaviors.

Compensating Controls: Ensure that third-party application installations are restricted through Mobile Device Management (MDM) policies to minimize the potential for malicious code to be introduced to the device.

Public Exploit Available: Yes — a proof-of-concept exists on GitHub.

Given the potential for complete local privilege escalation, this vulnerability represents a significant security risk to Android users. Organizations should prioritize the deployment of the March 2026 security updates across all managed devices to mitigate the risk of exploitation.