CVE-2026-0014: 
NixOS vulnerability analysis and mitigation

CVE-2026-0014 is an improper input validation vulnerability in the isPackageNullOrSystem function of AppOpsService.java in Google Android, enabling a persistent local denial of service. It affects Android versions 14.0, 15.0, 16.0, and 16.0 QPR2 variants. The vulnerability was published on March 2, 2026, with a patch included in the Android Security Bulletin 2026-03-01. It carries a CVSS v3.1 base score of 6.2 (Medium) (Android Bulletin, Red Hat CVE).

The root cause is improper input validation (CWE-20) in the isPackageNullOrSystem method of AppOpsService.java, a core Android system service responsible for managing application operation permissions. An attacker with local access can supply malformed or unexpected input that causes the AppOpsService to enter a persistent failure state, surviving reboots or service restarts. No elevated privileges are required, and no user interaction is needed to trigger the condition. The attack vector is local (AV:L), with low complexity (Android Bulletin).

Successful exploitation results in a persistent denial of service affecting the AppOpsService, which manages Android's application operations and permission enforcement framework. Because the denial of service is persistent, normal device reboots may not restore functionality, potentially rendering permission management inoperable until a patch is applied. There is no confidentiality or integrity impact; the vulnerability is limited to availability (A:H), but disruption of AppOpsService could indirectly affect applications relying on runtime permission checks (Android Bulletin, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Android Bulletin). No threat actor attribution has been identified. The EPSS score is approximately 0.006% (0.000060), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Google has released a patch addressing CVE-2026-0014 in the Android Security Bulletin dated 2026-03-01, covering Android versions 14.0, 15.0, and 16.0 (including QPR2 variants). Device manufacturers and carriers should apply the 2026-03-01 or 2026-03-02 security patch level to affected devices. Users should ensure their Android devices are updated to the March 2026 security patch level or later. No configuration-based workaround has been published; patching is the only recommended remediation (Android Bulletin).

The CIS Security advisory noted this vulnerability as part of a broader set of multiple vulnerabilities in Google Android OS that could allow for remote code execution and other impacts, recommending prompt patching (CIS Advisory). GBHackers reported on the March 2026 Android security update fixing 129 flaws, of which CVE-2026-0014 was one (GBHackers). No significant independent researcher commentary or social media discussion specific to this CVE has been identified.