CVE-2026-0008
Published: 02 March 2026
Summary
CVE-2026-0008 is a high-severity Confused Deputy (CWE-441) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Implements a reference monitor to mediate all accesses and enforce authorization, directly preventing confused deputy privilege escalations where components trust unverified callers.
Enforces approved access authorizations in accordance with policy, blocking local unprivileged attackers from escalating privileges via confused deputy flaws.
Applies least privilege to limit the scope of actions privileged components can take on behalf of untrusted callers in confused deputy scenarios.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local privilege escalation vulnerability (confused deputy) that directly enables an unprivileged attacker to obtain elevated privileges without user interaction.
NVD Description
In multiple locations, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2026-0008 is a privilege escalation vulnerability due to a confused deputy issue (CWE-441) present in multiple locations within Android. Published on 2026-03-02, it allows local escalation of privilege without requiring additional execution privileges or user interaction.
The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating low attack complexity for a local, unprivileged attacker. Successful exploitation enables high-impact confidentiality, integrity, and availability violations through privilege escalation on the affected Android device.
The Android security bulletin at https://source.android.com/security/bulletin/2026-03-01 details patches and mitigation measures for this vulnerability.
Details
- CWE(s)