CVE-2026-0098: Android Confused Deputy Privilege Escalation – Activity Start Bypass

Technical summary

The vulnerability resides in the getCallingPackageName method within Shared.java, affecting Android's activity launch validation framework. A confused deputy condition permits an unprivileged app to spoof or manipulate the caller identity used in permission checks. By crafting a request that misrepresents the calling package, an attacker can trigger activity starts that the system would normally block. This bypasses activity start restrictions (a core isolation boundary in Android) and enables privilege escalation from an app's baseline permissions to capabilities it should not possess. The attack vector is local (on-device) and requires no additional execution privileges or user acknowledgment, making it reliably exploitable by installed malware or a compromised legitimate app.

Business impact

This vulnerability poses a significant risk to device security and user privacy. An attacker exploiting CVE-2026-0098 could gain access to restricted system features—such as sensitive settings, call handling, or device administration capabilities—that would normally be unavailable to third-party apps. Enterprises managing Android fleets face potential data exfiltration, unauthorized configuration changes, or lateral movement within the device ecosystem. Device makers and carriers must prioritize patching to prevent widespread exploitation by APT groups or commodity malware that adapts to abuse this flaw.

Affected systems

This vulnerability affects multiple Android versions published by Google. The exact version boundaries and affected build levels should be verified against Google's official security advisory. Historically, such confused deputy issues in core Android frameworks impact a broad range of devices across manufacturers, as the flaw exists in shared Android Open Source Project (AOSP) code. Any Android device running an unpatched version is potentially vulnerable.

Exploitability

Exploitability is high. The attack requires no special permissions beyond basic app installation, no user interaction, and succeeds on the first attempt given the right conditions. An attacker does not need to compromise the device or gain shell access beforehand—a malicious or compromised app with minimal permissions can trigger the escalation locally. The confused deputy pattern is a well-understood attack class, and exploitation techniques are straightforward for a skilled adversary. No KEV (Known Exploited Vulnerability) listing is currently recorded, but the simplicity of the attack surface makes weaponization likely if detailed technical analysis becomes public.

Remediation

The primary remediation is to apply the Android security patch released by Google addressing this issue. Device manufacturers and carriers should prioritize the rollout of patched builds to all affected models. Users should enable automatic system updates and verify their device's security patch level is current. In the interim, security controls such as app allowlisting, disabling installation from untrusted sources, and monitoring for unusual activity can reduce exposure. Developers should review their own use of getCallingPackageName and related APIs to ensure they perform additional validation beyond package identity.

Patch guidance

Consult Google's official Android Security & Privacy Year-End Report and monthly security bulletin to identify the specific patch versions and affected devices. Patches are typically distributed through over-the-air (OTA) updates; enable automatic updates on all Android devices. Verify patch status via Settings > About Phone > Security patch level (or equivalent). Device manufacturers may lag in delivering patches—contact your OEM directly if a device remains unpatched 30 days after the CVE publication. Test patches in staging environments before broad rollout to ensure no regressions with internal apps or enterprise MDM tooling.

Detection guidance

Monitor for apps that attempt to launch restricted activities or access privileged system services without the corresponding manifest permissions. Endpoint Detection and Response (EDR) or Mobile Threat Defense (MTD) solutions can flag attempts to invoke protected intents or deprecated/privileged APIs. Review device logs for unexpected activity start events; escalation attacks often trigger permission denial logs followed by successful calls through alternate channels. Behavioral analytics may detect apps exhibiting out-of-profile capability usage—for example, a social media app suddenly accessing device administration features. If available, enable audit logging in your MDM console to track system API calls on managed devices.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high CVSS score (7.8), local attack vector, zero user interaction requirement, and the critical nature of activity start restrictions as an Android isolation boundary. The confused deputy pattern enables privilege escalation with minimal effort, creating risk for both consumer and enterprise devices. Although not yet on the KEV list, the simplicity of exploitation and broad impact on Android ecosystem justify urgent patching campaigns.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) Local attack vector—attacker must be on the device, limiting initial access but not remediation urgency given app-based threats; (2) Low attack complexity—no special conditions or race conditions needed; (3) Low privilege requirement—attacker needs only basic app permissions; (4) No user interaction—exploit succeeds automatically; (5) Confidentiality, Integrity, and Availability impact all marked High—successful exploitation grants access to sensitive data, system configuration, and potentially causes denial of service. The score appropriately emphasizes the severity while accounting for the local-only nature.

Frequently asked questions