CVE-2026-0021
Published: 02 March 2026
Summary
CVE-2026-0021 is a high-severity Confused Deputy (CWE-441) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access, directly preventing the cross-user permission bypass due to the confused deputy flaw in hasInteractAcrossUsersFullPermission.
Requires identification, reporting, and correction of flaws like CVE-2026-0021 through timely patching as specified in the Android security bulletin.
Implements a tamper-proof reference monitor that mediates all cross-user access decisions, countering the confused deputy permission bypass vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via permission bypass/confused deputy flaw.
NVD Description
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2026-0021 is a cross-user permission bypass vulnerability stemming from a confused deputy issue in the hasInteractAcrossUsersFullPermission method of AppInfoBase.java within the Android framework. This flaw affects Android devices, enabling local escalation of privilege without requiring additional execution privileges or user interaction. The vulnerability is rated with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-441 (Unintended Proxy or Intermediary).
A local attacker, even without any privileges, can exploit this vulnerability due to its low attack complexity and lack of prerequisites. Successful exploitation allows the attacker to gain elevated privileges across user boundaries, potentially compromising confidentiality, integrity, and availability with high impact.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 provides details on affected versions and patches for mitigation. Security practitioners should apply the recommended updates promptly to address this issue.
Details
- CWE(s)