Actively exploited in the wild
Android Pixel Privilege Escalation Vulnerability
Android - Pixel · Listed in the CISA KEV since 2024-06-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-32896
HighCVSS 7.8KEVSummary
The vulnerability is due to a logic error in the code that allows bypassing security controls. It could lead to local escalation of privilege with no additional execution privileges needed, but user interaction is required for exploitation.
Risk Assessment
Successful exploitation could allow an attacker to gain higher privileges on the system, potentially leading to device compromise.
Recommendation
Immediately apply the security updates provided by the vendor for the affected component.
Other vulnerabilities in Android
See all- CVE-2026-59028High
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-59022Unknown
In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59021Unknown
In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed.
- CVE-2026-59020Unknown
In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed.
- CVE-2026-59016Unknown
In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-59015Unknown
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59014Unknown
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-59012Unknown
In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59011Unknown
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed.
- CVE-2026-59010Unknown
In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.
Original NVD description (English source)
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS