A critical local privilege escalation vulnerability in Google Android allows an attacker to gain elevated system privileges without requiring user interaction.

This vulnerability resides in the setPackageOrComponentEnabled function within ManagedServices.java. It stems from improper input validation that leads to a notification policy desynchronization, which can be exploited by a local, unauthenticated attacker to achieve elevation of privilege.

The ability for a local attacker to escalate privileges to a system level poses a severe risk to device integrity and user data privacy. Given the CVSS score of 8.4, this vulnerability is classified as High severity because it allows a malicious actor to bypass security controls and potentially gain full control over the affected device. Such an exploit could lead to the unauthorized access of sensitive information or the installation of persistent malicious software.

Immediate Action: Users and administrators should apply the March 2026 Android security updates as provided by the device manufacturer immediately.

Proactive Monitoring: Monitor system logs for unusual activity related to ManagedServices or unauthorized modifications to notification policies.

Compensating Controls: Ensure that third party application installation is restricted to trusted sources and maintain strict device management policies to minimize the risk of local access by unauthorized parties.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk for Android users due to the potential for privilege escalation. Organizations managing fleets of Android devices should prioritize the deployment of the March 2026 security patches to all affected versions to mitigate the possibility of local exploitation.