CVE-2026-0008
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Risk Assessment
A local attacker can exploit this vulnerability to gain higher privileges, potentially enabling access to sensitive data or system functions. The lack of required user interaction increases the risk of exploitation.
Recommendation
It is recommended to apply patches provided by the system vendor. Also, restrict access to FaceEnroll-related functions and monitor the system for anomalies.
Other vulnerabilities in Android
See all- CVE-2016-0833High
Android allows users to cause a denial of service.
- CVE-2026-28606Critical
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2025-48595HighActively exploited
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
- CVE-2025-48626Critical
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2016-3877Critical
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
- CVE-2026-58744High
In multiple locations, improper input validation may lead to privilege escalation. Exploitation requires local access and needs no user interaction or additional execution privileges.
- CVE-2026-58724High
In multiple locations, a race condition leads to a use-after-free. This may result in local privilege escalation with System execution privileges required.
- CVE-2026-58699High
In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-58695High
In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-58691High
In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Original NVD description (English source)
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.