CVE-2026-0015: 
NixOS vulnerability analysis and mitigation

CVE-2026-0015 is an improper input validation vulnerability in Android's AppOpsService.java that enables a persistent local denial of service. It affects Google Android versions 14.0, 15.0, 16.0, and 16.0-qpr2 variants. The vulnerability was published on March 2, 2026, with a patch included in the Android March 2026 security bulletin. It carries a CVSS v3.1 base score of 6.2 (Medium) (Android Bulletin, Red Hat CVE).

The vulnerability is classified as CWE-20 (Improper Input Validation) and exists in multiple locations within AppOpsService.java, the Android system service responsible for managing app operations and permissions. An attacker can supply malformed or unexpected input to the affected service, causing it to enter a persistent failure state. The attack vector is local, requires no elevated privileges, and no user interaction is needed for exploitation (Android Bulletin).

Successful exploitation results in a persistent denial of service condition affecting the AppOpsService, which manages application permission operations on Android. Since the denial of service is described as persistent, the service may remain unavailable across reboots or until a patch is applied, potentially disrupting permission enforcement and app functionality on the affected device. There is no impact on confidentiality or integrity; only availability is affected (Android Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat CVE). The EPSS score is approximately 0.006%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Google released a patch addressing CVE-2026-0015 in the Android March 2026 security bulletin (patch level 2026-03-01). Users and administrators should apply the March 2026 Android security update to all affected devices running Android 14, 15, or 16. OEM-specific updates (e.g., Samsung, Huawei) incorporating this patch have also been released. No configuration-based workaround is publicly documented; patching is the recommended remediation (Android Bulletin, CIS Advisory).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in the March 2026 Android OS update, including CVE-2026-0015, and recommended prompt patching (CIS Advisory). Huawei also incorporated the fix in its April 2026 security bulletin for affected devices (Huawei Bulletin). Community discussion has been minimal given the medium severity and lack of public exploit code.