CVE-2026-0078: Android Frameworks Base Local Privilege Escalation Vulnerability
Summary
CVE-2026-0078: In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development and system functionality. It plays a critical role in managing device policies and configurations. This package is susceptible to vulnerabilities that can lead to unauthorized access or privilege escalation, impacting device security and user data integrity.
Vulnerability Detail
In the setGlobalProxy method of DevicePolicyManagerService.java, there exists a vulnerability due to improper input validation. This flaw can result in a desynchronization in persistence, allowing local escalation of privileges without requiring additional execution privileges. The vulnerability is significant as it can be exploited without user interaction, potentially compromising device security.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible to mitigate the risk.
Conclusion
CVE-2026-0078 represents a significant security risk within the Android Frameworks Base package, allowing local privilege escalation due to improper input validation. Immediate action is recommended to update to the patched versions to safeguard against potential exploitation.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-0078 is a vulnerability in the Android Frameworks Base package that allows local privilege escalation due to improper input validation in the setGlobalProxy method.
Exploitation of this vulnerability can lead to unauthorized access and control over device settings, potentially compromising user data and device security.
No, user interaction is not needed for exploitation, making it particularly dangerous.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no specific workarounds, it is crucial to prioritize updating your package to the patched version to mitigate risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
