CVE-2026-0070: Android DevicePolicyManagerService Local Denial of Service Vulnerability

Technical summary

CVE-2026-0070 stems from inadequate input validation in multiple functions within DevicePolicyManagerService.java. An authenticated local process can exploit this to obscure system-critical packages from visibility and accessibility, triggering a high-impact availability disruption. The vulnerability is rooted in CWE-20 (Improper Input Validation), allowing an attacker with local access and low privilege level to craft malicious parameters that bypass filtering logic.

Business impact

For organizations deploying Android devices—whether corporate-owned or bring-your-own-device—this vulnerability creates an operational risk. Compromised devices could become unreliable or require manual intervention to recover, disrupting productivity and increasing support costs. The ability to hide critical system packages may also interfere with mobile device management (MDM) policies, compliance controls, and security monitoring that depend on package visibility and integrity.

Affected systems

Google Android is the affected platform. The vulnerability impacts multiple versions and variants of the Android operating system. Affected organizations should verify the specific Android versions and security patch level of their deployed devices against Google's official security bulletins.

Exploitability

Exploitation requires local access to the device but no elevated privileges—any authenticated local process or application can trigger the flaw. No user interaction is needed, meaning the attack can occur silently. The attack surface includes any installed application with basic system access or any local process running in the device context. The low barrier to exploitation (AC:L) combined with the local-only requirement (AV:L) makes this readily exploitable in environments where untrusted apps are installed or where multiple users share device access.

Remediation

Apply the latest Android security patches released by Google to address improper input validation in DevicePolicyManagerService. Verify patch availability for your specific Android version and device model, as update availability varies by manufacturer and carrier. Additionally, review and enforce application whitelisting policies to limit which apps can interact with device policy functions, reducing the attack surface.

Patch guidance

Check Google's Android Security & Privacy Year in Review and monthly security bulletins for the patch version and date corresponding to CVE-2026-0070. Patch deployment timelines vary by device manufacturer and mobile carrier; prioritize updating devices in high-risk environments (finance, healthcare, government) first. For managed devices, use MDM solutions to push updates and verify successful remediation. Document the patching baseline and track unpatched devices for risk assessment.

Detection guidance

Monitor application behavior for unusual attempts to access or manipulate device policy settings, particularly calls to DevicePolicyManagerService functions with unexpected or invalid parameters. Audit device logs for denial-of-service events linked to package visibility (e.g., critical services becoming unavailable or inaccessible). On managed devices, use MDM telemetry to verify that system-critical packages remain visible and functional. Implement network-level monitoring to detect sudden loss of device communication patterns that might indicate system instability caused by hidden packages.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits prioritized attention because it affects a foundational Android system service with no privilege escalation required and no user interaction needed. The denial-of-service impact can compromise device reliability and compliance posture. Organizations with large Android deployments or strict uptime requirements should treat this as higher priority than the CVSS score alone suggests.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and high availability impact (A:H). The scope is unchanged (S:U), meaning the impact is confined to the affected system. The score correctly penalizes the local-only nature of the attack but appropriately weights the severity of the denial-of-service impact and the ease of exploitation by low-privileged processes.

Frequently asked questions