A critical local privilege escalation vulnerability in the Android operating system allows an attacker to bypass cross-user permissions without requiring user interaction.

This flaw exists within the hasInteractAcrossUsersFullPermission function of AppInfoBase.java, where a confused deputy logic error enables an attacker to perform actions outside their assigned security context without requiring special privileges or user interaction.

The ability for a local attacker to escalate privileges to a higher level of authority poses a severe risk to device integrity and user data confidentiality. With a CVSS score of 8.4, this vulnerability represents a high-severity threat that could lead to full system compromise, unauthorized access to sensitive application data, and the potential circumvention of Android security boundaries.

Immediate Action: Apply the March 2026 Android security updates provided by Google or your specific device manufacturer as soon as they become available.

Proactive Monitoring: Review system logs for anomalous application behavior or unexpected privilege changes that might indicate an attempt to exploit local system functions.

Compensating Controls: Maintain device security by ensuring that only trusted applications are installed from verified sources and that system-level security features like Google Play Protect remain enabled.

Public Exploit Available: Unknown

Given the potential for complete system compromise via local privilege escalation, organizations and individual users should prioritize the deployment of the March 2026 security patch. Android devices running versions 14 through 16 are currently exposed to this risk, making timely updates essential to maintaining the security posture of the mobile environment.