CVE-2026-55270: Android Telephony Framework Local Privilege Escalation Vulnerability
Summary
CVE-2026-55270: In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. Affects platform/frameworks/opt/telephony across 6 version ranges.
>= 14:0, < 14:2026-10-01
>= 15:0, < 15:2026-10-01
>= 16:0, < 16:2026-10-01
>= 16-qpr2:0, < 16-qpr2:2026-10-01
>= 17:0, < 17:2026-10-01
>= 17-next:0, < 17-next:2026-10-01
Fixed in 17-next:2026-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Telephony Framework is a core component of the Android operating system that manages telecommunication services, including voice calls, SMS, and mobile data. It provides essential APIs for applications to interact with telephony services. This framework is critical for the functionality of mobile devices, enabling communication features that users rely on daily. However, it has been found to have a vulnerability that could allow unauthorized access to sensitive functionalities.
Vulnerability Detail
The vulnerability identified as CVE-2026-55270 exists in the 'dialInternal' function within the Android Telephony Framework. It arises from a permission bypass due to a confused deputy, which means that an application could exploit this flaw to escalate privileges locally without requiring additional execution privileges. This could potentially allow malicious applications to perform actions that should be restricted, posing a significant security risk to users.
How To Fix
Minimum fixed version
17-next:2026-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit the permissions granted to applications that utilize telephony services until the patch can be applied. This can be done by reviewing application permissions in the device settings and revoking any unnecessary permissions.
Conclusion
The CVE-2026-55270 vulnerability in the Android Telephony Framework poses a significant risk of local privilege escalation. Users are strongly encouraged to update to the patched versions as soon as possible to mitigate potential security threats. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform/frameworks/opt/telephony →
FAQ
CVE-2026-55270 is a vulnerability in the Android Telephony Framework that allows local privilege escalation due to a permission bypass.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive telephony functionalities, which could lead to data breaches or unauthorized actions on the device.
To apply the patch, update the Android Telephony Framework to the latest version using the command 'gradle update platform/frameworks/opt/telephony'.
Yes, temporarily limit the permissions of applications that use telephony services until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/opt/telephony.
