CVE-2026-0047: Google Android Privilege Escalation Flaw

CVE-2026-0047 Overview

CVE-2026-0047 is a local privilege escalation vulnerability discovered in Google Android's ActivityManagerService.java. Specifically, the dumpBitmapsProto function lacks a proper permission check, allowing malicious applications to access private information without authorization. This vulnerability enables local privilege escalation without requiring any additional execution privileges or user interaction.

Critical Impact

Malicious applications can exploit this missing permission check to gain unauthorized access to sensitive system information and escalate privileges locally on affected Android devices.

Affected Products

• Google Android 16.0 QPR2 Beta 1
• Google Android 16.0 QPR2 Beta 2
• Google Android 16.0 QPR2 Beta 3

Discovery Timeline

• 2026-03-02 - CVE-2026-0047 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-0047

Vulnerability Analysis

This vulnerability falls under CWE-280 (Improper Handling of Insufficient Permissions or Privileges). The core issue resides in the dumpBitmapsProto method within ActivityManagerService.java, which is a critical Android system service responsible for managing application lifecycle, processes, and memory.

The ActivityManagerService is one of the most privileged system services in Android, and it handles numerous sensitive operations. The dumpBitmapsProto function, designed to export bitmap-related debugging information in Protocol Buffer format, fails to verify that the calling application possesses the required permissions before executing the dump operation.

This architectural flaw enables any local application—regardless of its declared permissions—to invoke this method and retrieve private system information. The attack can be executed locally without user interaction, making it particularly dangerous in scenarios where a seemingly benign application is installed on the device.

Root Cause

The root cause of CVE-2026-0047 is a missing permission check in the dumpBitmapsProto method of ActivityManagerService.java. Android's security model relies on explicit permission validation before granting access to sensitive data or operations. In this case, the method fails to call the appropriate permission-checking APIs (such as enforceCallingPermission() or checkCallingPermission()) before processing the request and returning potentially sensitive bitmap data.

Attack Vector

The attack vector is local, requiring a malicious application to be installed on the target device. Once installed, the malicious app can call the vulnerable dumpBitmapsProto method through standard Android IPC mechanisms without needing elevated privileges or user consent. The attacker can extract private information from the system, potentially using this data to further escalate privileges or compromise device security.

Since no user interaction is required, this vulnerability could be exploited silently in the background, making detection particularly challenging for end users.

Detection Methods for CVE-2026-0047

Indicators of Compromise

• Unexpected IPC calls to ActivityManagerService from non-system applications
• Applications accessing bitmap dump functionality without legitimate UI requirements
• Unusual process activity targeting system services with elevated privileges

Detection Strategies

• Monitor Binder IPC transactions for suspicious calls to dumpBitmapsProto from untrusted application contexts
• Implement runtime application monitoring to detect privilege escalation attempts
• Deploy endpoint detection solutions capable of identifying anomalous system service access patterns
• Review installed applications for suspicious permission requests or behaviors

Monitoring Recommendations

• Enable enhanced logging for ActivityManagerService operations on development and test devices
• Deploy mobile threat defense solutions that monitor system service interactions
• Regularly audit installed applications against known malicious app signatures
• Monitor for unauthorized data exfiltration from system processes

How to Mitigate CVE-2026-0047

Immediate Actions Required

• Update affected Android devices to the latest security patch level addressing CVE-2026-0047
• Review installed applications and remove any untrusted or suspicious apps
• Enable Google Play Protect for real-time malicious app detection
• Consider restricting app installations to trusted sources only

Patch Information

Google has addressed this vulnerability in the Android Security Bulletin March 2026. Device owners should check with their device manufacturer or carrier for the availability of security updates containing the March 2026 security patch level.

The fix involves adding proper permission verification in the dumpBitmapsProto method to ensure only authorized callers with appropriate system-level permissions can access the bitmap dump functionality.

Workarounds

• Limit app installations to Google Play Store or other verified enterprise app stores
• Use Android Enterprise or device management solutions to enforce application whitelisting
• Enable work profile isolation to separate sensitive data from potentially malicious personal apps
• Consider factory resetting affected devices if compromise is suspected, followed by a clean install with the latest security patches

# Check current Android security patch level
adb shell getprop ro.build.version.security_patch

# Verify the device is running a patched version (2026-03-01 or later)
# Expected output: 2026-03-01 or newer date