CVE-2026-0026: 
NixOS vulnerability analysis and mitigation

CVE-2026-0026 is a local privilege escalation vulnerability in Android 14.0 caused by a logic error in the removePermission function of PermissionManagerServiceImpl.java. The flaw allows a local attacker to override any system permission without requiring additional execution privileges, though user interaction is needed for exploitation. It was disclosed on March 2, 2026, as part of Google's Android Security Bulletin (2026-03-01). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Android Bulletin, Red Hat CVE).

The root cause is a logic error (CWE-862: Missing Authorization) in the removePermission method within PermissionManagerServiceImpl.java, a core component of Android's permission management subsystem. The flaw allows a local process or application to invoke this method in a way that bypasses authorization checks, effectively overriding any system-level permission. Exploitation requires local access to the device and some form of user interaction (e.g., installing a malicious application or triggering a specific UI action), but no elevated privileges are needed as a precondition. No public proof-of-concept code has been identified at this time (Android Bulletin).

Successful exploitation grants a local attacker the ability to override arbitrary system permissions, leading to full escalation of privilege on the affected Android 14.0 device. This can result in high confidentiality, integrity, and availability impacts — an attacker could access sensitive user data, modify system settings or files, and potentially render the device unstable or unusable. The attack is confined to the local device and does not directly enable remote code execution or lateral movement across a network (Android Bulletin, Feedly).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of reporting (Feedly). The EPSS score is approximately 0.006%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local device access and user interaction, which limits the attack surface compared to remote vulnerabilities.

Google has released a patch addressing this vulnerability in the Android Security Bulletin dated 2026-03-01. Users and administrators should apply the March 2026 security patch level (2026-03-01 or later) to all affected Android 14.0 devices as soon as possible. Samsung and Huawei have also released corresponding security updates for their Android-based devices (Android Bulletin, Samsung, Huawei). As a general precaution, limit installation of applications from untrusted sources and restrict user interaction with permission management interfaces where feasible.

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in the March 2026 Android OS update, including CVE-2026-0026, warning of potential privilege escalation risks (CIS Advisory). Samsung and Huawei both acknowledged the vulnerability in their respective March and April 2026 security bulletins. Community discussion on platforms such as Bluesky was limited, consistent with the low EPSS score and absence of active exploitation.