← Back

CVE-2026-45528

nvd nist
Published: Sep 8, 2026Modified: Sep 24, 2026

JSON object

Loading...
7.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.3 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Affected (5)

Products: Google: Android
Google
1 product
Android
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Google
Android
Version 14.0
Android
Version 15.0
Android
Version 16.0
Android
Version 16.0 qpr2
Android
Version 17.0

Related CWEs

CWE-926
Improper Export of Android Application Components
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

References (1)

Source: security@android.com
Vendor Advisory

Timeline

No history available yet.