CVE-2026-0013: 
NixOS vulnerability analysis and mitigation

CVE-2026-0013 is a confused deputy vulnerability in the setupLayout method of PickActivity.java within Android's DocumentsUI component, allowing a local attacker to start any activity as the DocumentsUI app and escalate privileges. It affects Google Android versions 14.0, 15.0, and 16.0. The vulnerability was published on March 2, 2026, with a patch included in the Android Security Bulletin dated 2026-03-01. It carries a CVSS v3.1 base score of 8.4 (High), requiring no privileges and no user interaction (Android Security Bulletin, Red Hat CVE).

The root cause is classified as CWE-441 (Unintended Proxy or Intermediary — 'Confused Deputy'), where the setupLayout method in PickActivity.java can be abused to launch arbitrary Android activities under the identity and privileges of the DocumentsUI application. An attacker with local access to the device can craft an intent that exploits this flaw without requiring any elevated permissions or user interaction. The attack vector is local, with low complexity, making it straightforward to exploit once local access is established (Android Security Bulletin).

Successful exploitation allows any unprivileged local user to escalate their privileges to those of the DocumentsUI application, enabling reading and modification of sensitive files accessible to that component, as well as execution of arbitrary activities within its security context. The vulnerability has high confidentiality, integrity, and availability impact per its CVSS scoring. While lateral movement to remote systems is not directly enabled, the privilege escalation could facilitate further attacks on the device, including access to documents and storage managed by DocumentsUI (Android Security Bulletin, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.006%, reflecting a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Local Access: Obtain local (physical or shell) access to an Android device running version 14.0, 15.0, or 16.0 without a March 2026 or later security patch.
2. Craft Malicious Intent: Construct an Android Intent targeting PickActivity within the DocumentsUI package (com.android.documentsui), designed to trigger the vulnerable setupLayout method.
3. Invoke Confused Deputy: Send the crafted intent to PickActivity, exploiting the confused deputy flaw to cause DocumentsUI to launch an arbitrary target activity on the attacker's behalf, inheriting DocumentsUI's privileges.
4. Privilege Escalation: The target activity executes under DocumentsUI's security context, granting the attacker access to sensitive files, storage, and system operations normally restricted to that application (Android Security Bulletin).

• Logs: Android system logs (logcat) showing unexpected activity launches originating from com.android.documentsui (PickActivity) to unrelated or suspicious target activities.
• Process/Activity: Unusual activities or processes running under the DocumentsUI UID (u0_a<X> associated with com.android.documentsui) that are not normally associated with document picking workflows.
• File System: Unexpected access or modification of files in storage locations managed by DocumentsUI, particularly outside of normal user-initiated document operations.

Google has released a patch addressing CVE-2026-0013 in the Android Security Bulletin for 2026-03-01, covering Android versions 14.0, 15.0, and 16.0. Users and administrators should immediately apply the March 2026 security patch to all affected Android devices. No configuration-based workaround is available; upgrading to the patched security patch level (2026-03-01 or later) is the only recommended remediation. Samsung and Huawei have also incorporated this fix in their respective March 2026 security updates (Android Security Bulletin, Samsung March 2026).

The CIS issued an advisory noting multiple vulnerabilities in Google Android OS that could allow for privilege escalation, including CVE-2026-0013 (CIS Advisory). Samsung and Huawei both acknowledged the vulnerability in their respective March and April/May 2026 security bulletins. Community and social media coverage has been limited, with no notable researcher commentary or significant public discussion beyond standard vulnerability tracking.