CVE-2026-49189
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
Risk Assessment
Local malware can perform administrative operations without proper permissions, potentially leading to privilege escalation or system integrity compromise.
Recommendation
Restrict access permissions to the Broadcast Receiver by requiring appropriate permissions or application signing.
Other vulnerabilities in Android
See all- CVE-2016-0833High
Android allows users to cause a denial of service.
- CVE-2025-48595HighActively exploited
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
- CVE-2025-48626Critical
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2016-3877Critical
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
- CVE-2026-24088High
A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.
- CVE-2026-28586Low
In multiple functions of AppOpsService.java, there is a missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28581Medium
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, a logic error allows making an emergency call without proper privileges.
- CVE-2026-28580High
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28578Medium
In multiple functions of DevicePolicyManagerService.java, a desync from persistence due to improper input validation could lead to local denial of service.
- CVE-2026-28577High
In the addWindow method of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.
Original NVD description (English source)
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.