CVE-2026-0035: 
NixOS vulnerability analysis and mitigation

CVE-2026-0035 is a local privilege escalation vulnerability in Android's MediaProvider.java that allows an app to gain unauthorized read/write access to non-existing files due to a logic error in the createRequest method. It affects Android versions 14.0, 15.0, and 16.0 (including QPR2 beta variants). The vulnerability was published on March 2, 2026, and patched in the Google Android March 2026 security bulletin (2026-03-01). It carries a CVSS v3.1 base score of 8.4 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is a logic error (CWE-125: Out-of-bounds Read; CWE-787: Out-of-bounds Write) in the createRequest method of MediaProvider.java, a core Android component responsible for managing media file access. The flaw allows a locally installed app to manipulate file access requests in a way that grants read/write permissions to files that do not yet exist, bypassing normal access controls. Exploitation requires no additional privileges and no user interaction, making it a zero-interaction local attack. The attack vector is local (AV:L), with low complexity and no privileges required (Android Security Bulletin).

Successful exploitation allows a malicious local app to escalate its privileges and gain read/write access to files outside its permitted scope, including files that should not be accessible or do not yet exist on the device. This impacts confidentiality, integrity, and availability — all rated High — potentially enabling data theft, file tampering, or further compromise of the device. The vulnerability does not require user interaction, increasing the risk of silent exploitation by malicious applications (Android Security Bulletin, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.006%, indicating a very low current probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures have been published by Qualys (detection IDs 610761 and 610767).

Google released a patch for CVE-2026-0035 in the Android Security Bulletin dated March 1, 2026 (patch level 2026-03-01), covering Android 14.0, 15.0, and 16.0. Device owners should apply the March 2026 security update as soon as it is made available by their device manufacturer or carrier. Samsung's March 2026 security patch also addresses this vulnerability. Users of GrapheneOS should update to the latest release, which incorporates the fix (Android Security Bulletin, Samsung Fans).

The CIS published an advisory noting multiple vulnerabilities in Google Android OS that could allow for privilege escalation, including CVE-2026-0035 (CIS Advisory). The vulnerability received brief coverage on social media platforms including Bluesky and Mastodon, primarily from automated CVE tracking accounts. Huawei also referenced the vulnerability in its April 2026 security bulletin for affected devices.