CVE-2026-0011: 
NixOS vulnerability analysis and mitigation

CVE-2026-0011 is a local privilege escalation vulnerability in Google Android affecting the enableSystemPackageLPw function in Settings.java. A logic error in the code allows an unauthenticated local attacker to bypass location access restrictions and escalate privileges without any user interaction. Affected versions include Android 14.0, 15.0, and 16.0 (including QPR2 beta variants). The vulnerability was published on March 2, 2026, and carries a CVSS v3.1 base score of 8.4 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is classified under CWE-693 (Protection Mechanism Failure) and CWE-703 (Improper Check or Handling of Exceptional Conditions), stemming from a logic error in the enableSystemPackageLPw method of Settings.java within the Android package management subsystem. The flaw allows a local, unprivileged process to interfere with location access enforcement, effectively bypassing the protection mechanism that restricts system package enablement. The attack vector is local (AV:L), requires no privileges (PR:N), and no user interaction (UI:N), making it straightforward to exploit from any app or process running on the device (Android Security Bulletin).

Successful exploitation leads to local escalation of privilege with high impact on confidentiality, integrity, and availability. An attacker can bypass location access restrictions enforced by the Android system, potentially gaining unauthorized access to sensitive location data and other protected resources. The vulnerability could be leveraged as part of a broader attack chain to gain elevated system-level access on affected Android 14, 15, and 16 devices (Android Security Bulletin, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Android Security Bulletin). The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys scanners have detection coverage for this CVE (detection IDs: 610761, 610765, 610767).

Google addressed this vulnerability in the Android Security Bulletin dated 2026-03-01. Devices running Android 14.0, 15.0, and 16.0 should be updated to the patched security patch level of 2026-03-01 or later as soon as possible. Samsung and other OEMs have incorporated this fix into their March 2026 security updates (Android Security Bulletin, Samsung Security). No configuration-based workaround is publicly documented; applying the vendor patch is the only recommended remediation.

The CIS published an advisory noting multiple vulnerabilities in Google Android OS that could allow for remote code execution and privilege escalation, including CVE-2026-0011 (CIS Advisory). Samsung acknowledged the issue in its March 2026 security update communications (Samsung Security). Community coverage has been limited, consistent with the low EPSS score and absence of public exploit code.