CVE-2026-0020

Published: Mar 2, 2026Modified: Mar 6, 2026

8.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected (6)

Products: Google: Android

Google

1 product

Android

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 14.0
Google Android	Version 15.0
Google Android	Version 16.0
Google Android	Version 16.0 qpr2_beta_1
Google Android	Version 16.0 qpr2_beta_2
Google Android	Version 16.0 qpr2_beta_3

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

https://source.android.com/docs/security/bulletin/2026/2026-03-01

Source: security@android.com

Timeline

No history available yet.