CVE-2026-0047: 
NixOS vulnerability analysis and mitigation

CVE-2026-0047 is a missing permission check vulnerability in the dumpBitmapsProto method of ActivityManagerService.java on Android, enabling local privilege escalation and unauthorized access to private information. It affects Android 16.0 QPR2 Beta 1, Beta 2, and Beta 3. The vulnerability was published on March 2, 2026, with a patch included in the Android March 2026 Security Bulletin (2026-03-01 patch level). It carries a CVSS v3.1 base score of 8.4 (High) (Android Security Bulletin, Red Hat CVE).

The root cause is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges): the dumpBitmapsProto function in ActivityManagerService.java fails to enforce an appropriate permission check before allowing access to bitmap data, which may contain sensitive screen content or application state. The attack vector is local — a malicious application installed on the device can invoke this code path without requiring any elevated privileges or user interaction. Because no preconditions beyond local code execution are required, any app on an affected Android 16.0 QPR2 beta device can trigger the vulnerability (Android Security Bulletin).

Successful exploitation allows an unprivileged local application to access private information (such as screen bitmaps or sensitive activity data) and achieve local escalation of privilege, with high impact to confidentiality, integrity, and availability. An attacker could leverage this to read data belonging to other applications or the system, potentially enabling further lateral movement within the device. The scope is limited to the affected device, but the combination of privilege escalation and data exposure makes this a significant risk for users running affected Android 16.0 QPR2 beta builds (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.006% (0.000060), indicating a very low probability of exploitation in the near term. No threat actor attribution has been made (Android Security Bulletin).

Google released a patch addressing CVE-2026-0047 in the Android March 2026 Security Bulletin at the 2026-03-01 patch level. Users and administrators should update all affected Android 16.0 QPR2 beta devices to the patched version as soon as it is available through their device manufacturer or carrier. No configuration-based workaround has been published; applying the security update is the only recommended remediation (Android Security Bulletin).

The March 2026 Android Security Bulletin received broad coverage from security media outlets including GBHackers, CyberSecurityNews, SecurityOnline, and HelpNetSecurity, primarily focused on the broader bulletin (129 vulnerabilities patched) and a separately exploited Qualcomm zero-day (CVE-2026-21385). CVE-2026-0047 itself did not attract significant standalone commentary. CIS issued an advisory noting multiple vulnerabilities in the Android OS update (CIS Advisory).