A high-severity local privilege escalation vulnerability in Android allows attackers to launch background activities, potentially compromising device security without user involvement.

The vulnerability exists within the executeRequest function of ActivityStarter.java, where a logic flaw permits the unauthorized launch of background activities. This flaw enables an attacker with local, low-privileged access to escalate their privileges without needing user interaction.

Successful exploitation of this vulnerability allows a local attacker to gain elevated privileges, potentially resulting in full system compromise, unauthorized data access, or the installation of malicious applications. Given the CVSS score of 7.8, this flaw represents a significant risk to the integrity and confidentiality of data stored on affected Android devices. Organizations should consider this a priority, particularly for fleets of managed mobile devices.

Immediate Action: Apply the latest security updates provided by Google or your specific device manufacturer as soon as they become available.

Proactive Monitoring: Monitor device logs for unusual activity or unexpected application launches that deviate from normal user behavioral patterns.

Compensating Controls: Ensure that enterprise mobility management (EMM) policies are enforced to restrict sideloading of applications and maintain strict control over device permissions.

Public Exploit Available: No (exploit_available: false)

This vulnerability poses a substantial risk due to the potential for privilege escalation without user intervention. Administrators should prioritize the deployment of the September 2026 Android security bulletin updates across all managed devices. Failure to patch may leave devices susceptible to local attacks that could bypass standard security boundaries.