CVE-2026-0072: Android XR InputMethodManagerService Privilege Escalation (CVSS 7.8)

Technical summary

CVE-2026-0072 is a privilege escalation vulnerability in the InputMethodManagerService component (specifically the addInputMethodListener method) of Android XR. The vulnerability stems from inadequate authorization checks on a sensitive function, permitting a low-privileged local process to invoke functionality reserved for system or privileged callers. The attacker gains the ability to modify input method behavior without proper credential validation, leading to complete compromise of device confidentiality, integrity, and availability.

Business impact

This vulnerability poses a significant risk in enterprise deployments of Android XR devices, particularly in shared or BYOD scenarios. Attackers exploiting this flaw can exfiltrate sensitive data, modify device behavior without detection, install malicious input methods to harvest credentials, or deny service. For organizations relying on Android XR for productivity or security-sensitive tasks, unpatched devices become a trusted-network infiltration point.

Affected systems

Google Android XR is the confirmed affected product. Organizations should inventory all Android XR deployments and prioritize testing the availability of vendor patches. Related Android platforms may warrant defensive review depending on shared code paths.

Exploitability

Exploitation requires local system access but no elevated starting privileges and no user interaction. An attacker already present on the device (through another compromise, physical access, or legitimate low-privilege account) can immediately trigger the flaw. The straightforward nature of the missing check makes this vulnerability straightforward to exploit once access is obtained.

Remediation

Apply the latest security patch from Google for Android XR as soon as it becomes available. Organizations should verify patch availability against the official Android Security & Privacy Year in Review and device-specific update schedules. Until patched, restrict physical access and limit installation of untrusted applications on Android XR devices.

Patch guidance

Monitor the Google Android Security & Privacy bulletin and your device manufacturer's security update page for the availability of patches addressing CVE-2026-0072. Apply patches to all Android XR devices in your environment systematically, beginning with production and high-risk deployments. Validate remediation by confirming the patched version is running post-update.

Detection guidance

Detection of exploitation is challenging without behavioral baselines. Monitor for unusual input method installation or modification events in system logs. Implement application allowlisting on Android XR devices to prevent unauthorized input method installation. Detect anomalous process interaction with InputMethodManagerService via audit logging if your deployment supports it. Alert on unexpected privilege escalation patterns tied to input-related processes.

Why prioritize this

The HIGH CVSS 3.1 score (7.8) reflects the combination of local attack surface, complete impact scope (confidentiality, integrity, and availability all compromised), and lack of user interaction or additional privileges required. The absence of KEV status should not lower prioritization—this is a straightforward privilege escalation in a core system service. Organizations should treat this as urgent, especially if Android XR is deployed in sensitive roles.

Risk score, explained

CVSS 3.1 score 7.8 (HIGH) is derived from: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The LOW privilege requirement acknowledges an attacker needs a foothold; however, the complete control achieved elevates severity substantially. Real-world risk is amplified in shared-device scenarios.

Frequently asked questions