CVE-2026-0013

HighCVSS 8.4/10Last modified Aug 26, 2026

Description

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-441

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2026
Last modified
Aug 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-00146.2In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This coulCVE-2026-00156.2In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lCVE-2026-00163.3In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a peCVE-2026-00177.7In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could leadCVE-2026-00185.5In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validationCVE-2026-00197.8In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation oCVE-2026-00208.4In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a perCVE-2026-00218.4In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. ThisCVE-2026-00237.8In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permisCVE-2026-00244.0In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missinCVE-2026-00258.4In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead toCVE-2026-00267.8In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in
CVE-2026-0013: High severity, CVSS 8.4 | Vulnix