CVE-2026-0026
Published: 02 March 2026
Summary
CVE-2026-0026 is a high-severity Missing Authorization (CWE-862) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the logic error in PermissionManagerServiceImpl by enforcing approved authorizations to prevent unauthorized system permission overrides.
Requires timely identification, reporting, and correction of the specific flaw via patches detailed in the Android security bulletin.
Limits damage from privilege escalation by ensuring only minimal privileges are granted, complementing flawed permission enforcement.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via permission override logic flaw (T1068).
NVD Description
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed…
more
for exploitation.
Deeper analysisAI
CVE-2026-0026 is a logic error in the removePermission function of PermissionManagerServiceImpl.java within the Android Open Source Project. This flaw enables an attacker to override any system permission, resulting in a local escalation of privilege vulnerability. No additional execution privileges are required for exploitation, though user interaction is necessary. The issue is scored at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-862.
A local attacker can exploit this vulnerability by leveraging the logic error to manipulate permission overrides. With no prerequisite privileges and low attack complexity, the attacker tricks a user into performing a specific interaction, such as granting or revoking permissions through a malicious app or interface. Successful exploitation allows full control over system permissions, providing high impacts on confidentiality, integrity, and availability.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 provides details on available patches and mitigation recommendations for affected Android versions.
Details
- CWE(s)