CVE-2026-0020
Published: 02 March 2026
Summary
CVE-2026-0020 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 requires enforcement of approved authorizations for access, directly mitigating the consent dialog bypass in parsePermissionGroup of ParsedPermissionUtils.java.
SI-2 mandates identification, reporting, and correction of flaws like CVE-2026-0020, enabling application of patches from the Android security bulletin.
SI-10 enforces validation of information inputs to the parsePermissionGroup function, preventing authorization bypass through user-controlled keys as described in CWE-639.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via permissions/consent bypass in Android permission parsing logic.
NVD Description
In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
Deeper analysisAI
CVE-2026-0020 is a permissions bypass vulnerability located in the parsePermissionGroup function of ParsedPermissionUtils.java within the Android platform. The flaw enables attackers to circumvent a consent dialog and obtain permissions without additional execution privileges required. Published on 2026-03-02, it is rated with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-639 (Authorization Bypass Through User-Controlled Key).
A local attacker can exploit this vulnerability due to its low attack complexity and lack of need for user interaction. With no prior privileges (PR:N), the attacker achieves local escalation of privilege, granting high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H).
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 provides details on affected versions and available patches for mitigation.
Details
- CWE(s)