CVE-2026-0034
Published: 02 March 2026
Summary
CVE-2026-0034 is a high-severity Improper Input Validation (CWE-20) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0034 is a vulnerability in the setPackageOrComponentEnabled function of ManagedServices.java within the Android Open Source Project, stemming from improper input validation (CWE-20). This flaw causes a notification policy desynchronization, enabling local escalation of privilege without requiring additional execution privileges or user interaction. Published on 2026-03-02, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its low complexity and unprivileged access vector.
A local attacker can exploit this vulnerability by triggering the flawed input validation in ManagedServices.java, leading to a desync in notification policies. With no privileges or user interaction needed, the attacker achieves full confidentiality, integrity, and availability impacts, escalating from an unprivileged state to higher privileges on the affected Android device.
The Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-03-01 details patches and mitigation guidance for this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9247
Vulnerability details
In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation via exploitation of improper input validation vulnerability directly matches T1068.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires information input validation mechanisms at input points, addressing the improper input validation in setPackageOrComponentEnabled that causes notification policy desync and privilege escalation.
Mandates identification, reporting, and correction of flaws like the input validation vulnerability in ManagedServices.java, enabling timely patching as detailed in the Android security bulletin.
Enforces least privilege principle to restrict unauthorized access and limit the impact of local privilege escalation resulting from notification policy desynchronization.