CVE-2026-0013: DocumentsUI Package Local Escalation of Privilege Vulnerability
Summary
CVE-2026-0013: In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. Affects platform/packages/apps/DocumentsUI across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The DocumentsUI package is an essential component of the Android operating system, providing users with a user-friendly interface to manage and interact with documents and files across various applications. It facilitates file selection and management tasks, allowing seamless integration with other apps. However, this package has been identified to have a vulnerability that could potentially allow unauthorized access to system activities.
Vulnerability Detail
In the setupLayout method of PickActivity.java, there exists a confused deputy vulnerability that allows any activity to be started as a DocumentsUI app. This flaw can lead to local escalation of privilege without requiring additional execution privileges or user interaction, posing significant security risks.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patches as soon as possible to mitigate the risk.
Conclusion
The CVE-2026-0013 vulnerability in the DocumentsUI package poses a significant security risk due to its potential for local escalation of privilege. It is essential to apply the provided patches to ensure the security of your applications and systems.
See every vulnerability recorded for platform/packages/apps/DocumentsUI →
FAQ
CVE-2026-0013 is a vulnerability in the DocumentsUI package that allows local escalation of privilege due to a confused deputy issue in the setupLayout method.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without requiring signup.
The vulnerability can lead to unauthorized access to system activities, allowing malicious actors to escalate privileges without user interaction, which can compromise system security.
No, user interaction is not needed for exploitation, making it particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/DocumentsUI.
