CVE-2026-0063: Android Carrier Restriction Bypass Leading to Local Privilege Escalation

Technical summary

CVE-2026-0063 is a privilege escalation vulnerability in PhoneInterfaceManager.java affecting the setAllowedCarriers function. A logic error in the carrier restriction enforcement mechanism allows a local process running with standard user-level privileges (PR:L) to escalate to higher capability by manipulating carrier allowlists. The vulnerability is classified as CWE-269 (Improper Access Control) and carries a CVSS v3.1 score of 7.8 (HIGH), reflecting high impact across confidentiality, integrity, and availability. No network access is required (AV:L), conditions are minimal (AC:L), and exploitation requires no user interaction (UI:N).

Business impact

This vulnerability creates a direct path for local privilege escalation on Android devices. An attacker who has already compromised a device—whether through malware, physical access, or another vulnerability—can leverage this flaw to gain elevated control over carrier settings, potentially enabling SIM-swap attacks, carrier-level data interception, or blocking legitimate carrier services. For organizations managing fleets of Android devices, this represents a risk that an internal or supply-chain threat could escalate to near-complete device compromise. Users with business-critical communications or sensitive carrier-dependent operations face elevated risk if their devices run unpatched Android versions.

Affected systems

Google Android devices are affected. The precise Android versions impacted, vendor-specific backports, and derivative distributions should be confirmed against Google's official security bulletin and corresponding OEM advisories. Devices with older or unmanaged OS versions that have not received the patch are at highest risk.

Exploitability

Exploitation is straightforward and requires only local code execution at user privilege level. No special system permissions, kernel bugs, or multi-stage techniques are necessary. Any local application or process can trigger the vulnerability, making it a natural post-compromise escalation vector. The absence of additional execution privileges required (PR:L), minimal attack complexity (AC:L), and no user interaction (UI:N) mean that exploitation is reliable and fast once local access is established. This is not a vulnerability that depends on user error or lucky timing.

Remediation

Apply the security patch provided by Google and distributed by your device manufacturer as soon as it becomes available. Check your device's Settings > System > System Update menu for available patches, and enable automatic updates if your organization's policy permits. Verify that the patch date is on or after June 17, 2026 (the vulnerability publication date). For devices that cannot receive patches, consider restricting local app installation, enforcing managed device profiles, or retiring devices from sensitive use cases.

Patch guidance

Google will provide patches through its monthly Android security bulletin. OEMs including Samsung, OnePlus, Xiaomi, and others will backport patches to their supported device lines on their own schedules, typically within 1-3 months of Google's release. Verify the patch version number and date against the official vendor advisory for your specific device model. Enable automatic system updates where possible to ensure timely patching. Organizations using Android Enterprise may leverage managed update policies to accelerate rollout.

Detection guidance

Monitor for unexpected modifications to carrier settings or device configuration using mobile device management (MDM) solutions. Look for anomalous calls to PhoneInterfaceManager methods or changes to carrier allowlist files in device logs. On Android Enterprise managed devices, use Google Play Protect and MDM agent logs to detect suspicious app behavior attempting to modify carrier policies. Baseline your environment's carrier configurations and alert on deviations.

Why prioritize this

This vulnerability merits urgent attention because local privilege escalation at user level (PR:L) is a common gateway for attackers already inside a network or on a compromised device. The lack of user interaction and minimal complexity means it will be incorporated into post-exploitation toolkits quickly. Organizations should prioritize patching before the vulnerability becomes actively weaponized, especially for devices handling communications or financial transactions.

Risk score, explained

The CVSS 7.8 (HIGH) score reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) achievable with only local access and no special privileges. The vulnerability is not network-reachable and does not require user interaction, which contains scope somewhat, but the reliable nature of the exploit and the ubiquity of Android mean real-world impact will be significant. Organizations managing devices in regulated industries should treat this as a critical priority.

Frequently asked questions