CVE-2026-0091
Code Execution in Android Launcher via Over-Privileged Shell
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: Android (associated with Google Inc. or Open Handset Alliance)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in multiple locations where the launcher process can execute code due to an over-privileged shell user.
Because the shell user has more privileges than necessary, it allows code execution that can lead to local escalation of privilege without requiring any additional execution privileges.
Importantly, exploitation of this vulnerability does not require any user interaction.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker or malicious code to escalate privileges locally on the affected system.
Since no additional execution privileges or user interaction are needed, an attacker with access to the shell user could execute arbitrary code with higher privileges, potentially compromising system security.