CVE-2026-0091: Android Launcher Privilege Escalation Vulnerability (CVSS 7.8)

Technical summary

CVE-2026-0091 stems from improper privilege management (CWE-269) affecting the Android launcher process across multiple code locations. The vulnerability allows a process running as the shell user to execute code in the launcher's execution context, effectively bypassing privilege boundaries. The CVSS 3.1 score of 7.8 (HIGH) reflects the local attack vector, low complexity, requirement for local privileges, and the complete compromise of confidentiality, integrity, and availability within the affected process scope.

Business impact

Successful exploitation could allow a compromised or malicious local application to escalate privileges and gain control over core Android system functionality. This threatens the integrity of the device's app ecosystem, user data privacy, and system stability. Organizations managing Android devices—particularly enterprises deploying company phones or tablets—face increased risk if this vulnerability remains unpatched, especially in environments where threat actors have already achieved initial local access.

Affected systems

Google Android is affected across multiple versions and configurations. The vulnerability resides in multiple locations within the codebase, suggesting widespread exposure across Android releases. Verify the specific Android versions and security patch levels impacted by consulting Google's official security advisory and your device manufacturer's update schedule.

Exploitability

The vulnerability requires local access but no additional execution privileges beyond standard user-level permissions. No user interaction is needed for successful exploitation, meaning an attacker with shell-level access can trigger code execution immediately. This lowers the practical barrier to exploitation compared to vulnerabilities requiring social engineering or user action. However, the requirement for existing local access does restrict opportunistic remote exploitation scenarios.

Remediation

Apply security patches released by Google and your device manufacturer as soon as they become available. Patches will address the privilege boundary issue in the launcher process. Monitor your device's security patch level and ensure automatic updates are enabled where policy permits. Organizations should prioritize deployment in environments where local threat actors or untrusted applications pose elevated risk.

Patch guidance

Check Google's official Android security bulletin for CVE-2026-0091 to identify patched versions and affected branches. Device manufacturers including Samsung, OnePlus, and others will release patches through their respective channels; consult your device manufacturer's support page for specific timelines. Apply patches systematically to your fleet and verify successful deployment, as launcher functionality affects all users.

Detection guidance

Monitor for unusual process execution within the launcher process or unexpected privilege escalations originating from shell user context. On managed devices, enable security logging to capture launcher process anomalies. Look for application manifests requesting elevated permissions or targeting launcher-specific functionality. Endpoint detection and response (EDR) solutions should flag attempts to write to or execute from launcher process memory.

Why prioritize this

Though CVE-2026-0091 is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, the high CVSS score (7.8), local exploitation ease, and critical role of the launcher process in Android functionality warrant prioritization. Organizations with high-risk device populations or strict compliance requirements should treat this as urgent; mainstream deployments should schedule patching within normal cycles but prioritize over lower-severity issues.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects: (1) local attack vector—requires device access but common in lost/stolen or compromised device scenarios; (2) low attack complexity—no special conditions needed; (3) low privilege requirement—shell user access is standard; (4) no user interaction; and (5) complete impact across confidentiality, integrity, and availability within the launcher process scope. The score does not reflect potential for lateral movement or system-wide compromise, which are possible but context-dependent.

Frequently asked questions