CVE-2026-0013
Published: 02 March 2026
Summary
CVE-2026-0013 is a high-severity Confused Deputy (CWE-441) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations in DocumentsUI's setupLayout to prevent attackers from tricking the app into starting arbitrary activities as a confused deputy.
Validates inputs to the setupLayout method in PickActivity.java to block malicious intents exploiting the confused deputy vulnerability.
Limits DocumentsUI privileges to only necessary activities, reducing the potential impact of confused deputy-based local privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes local privilege escalation via exploitation of a confused deputy vulnerability in Android DocumentsUI, directly matching T1068 Exploitation for Privilege Escalation.
NVD Description
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
Deeper analysisAI
CVE-2026-0013 is a vulnerability in the setupLayout method of PickActivity.java within Android's DocumentsUI component. It stems from a confused deputy issue (CWE-441) that allows an attacker to start any activity as the DocumentsUI app, enabling local escalation of privilege without additional execution privileges or user interaction. The vulnerability carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-02.
A local attacker requires only local access to the Android device with no privileges (PR:N) and can exploit the issue with low complexity (AC:L) and no user interaction (UI:N). Exploitation allows the attacker to escalate privileges, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
For mitigation details, refer to the Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01.
Details
- CWE(s)