CVE-2026-0056: Google Android Information Disclosure Flaw

CVE-2026-0056 Overview

CVE-2026-0056 is an out-of-bounds read vulnerability in the setTo function of ResourceTypes.cpp within the Google Android operating system. The flaw stems from an incorrect bounds check that allows a local attacker with low privileges to read memory outside the intended buffer. Successful exploitation results in local information disclosure without requiring user interaction or additional execution privileges. The issue is tracked under CWE-120 and affects Android 14, 15, and 16, including multiple QPR2 beta builds. Google addressed the vulnerability in the Android Security Bulletin June 2026.

Critical Impact

A local, low-privileged process can read out-of-bounds memory in ResourceTypes.cpp, leading to disclosure of sensitive process data without user interaction.

Affected Products

• Google Android 14.0
• Google Android 15.0
• Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)

Discovery Timeline

• 2026-06-01 - Google publishes fix in the Android Security Bulletin June 2026
• 2026-06-01 - CVE-2026-0056 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-0056

Vulnerability Analysis

The vulnerability resides in the setTo method of ResourceTypes.cpp, a core component of Android's resource handling subsystem. The function performs an incorrect bounds check before accessing buffer memory, allowing a read to extend beyond the allocated region. Attackers exploit this condition locally on the device, requiring only low-level privileges already available to installed applications. The disclosed memory may contain pointers, fragments of other application data, or kernel-adjacent structures useful for chaining with additional vulnerabilities. The CWE-120 classification reflects the buffer copy without proper size validation. The EPSS probability of 0.004% indicates a very low likelihood of imminent exploitation in the wild.

Root Cause

The root cause is an incorrect bounds check in setTo within ResourceTypes.cpp. The check fails to fully validate the relationship between the source length and destination buffer capacity before reading. As a result, the function reads past the end of the intended memory region during resource parsing.

Attack Vector

Exploitation requires local access to the device and an attacker-controlled process with low privileges. A malicious application crafts resource data that triggers the flawed setTo path, causing the runtime to return out-of-bounds memory contents. No user interaction is required, and the attacker gains read-only access to adjacent memory rather than direct code execution.

No verified proof-of-concept code is publicly available. Refer to the Android Security Bulletin June 2026 for vendor technical details.

Detection Methods for CVE-2026-0056

Indicators of Compromise

• Installed applications invoking unusual resource parsing APIs that interact with ResourceTypes structures at high frequency.
• Crash logs or tombstone files referencing setTo or ResourceTypes.cpp with SIGSEGV or sanitizer-reported out-of-bounds reads.
• Applications requesting access to other apps' resource files or asset bundles outside their sandbox.

Detection Strategies

• Enable Android's HWASan or ASan builds in test environments to catch out-of-bounds reads in libandroidfw during application analysis.
• Review mobile threat defense telemetry for applications that load malformed APK or resource archives.
• Correlate Play Protect and enterprise mobility management (EMM) alerts on suspicious low-privilege apps targeting resource parsers.

Monitoring Recommendations

• Track Android patch level (ro.build.version.security_patch) across the managed device fleet and flag devices below the 2026-06-01 patch level.
• Monitor application behavior for repeated reads of foreign resource files or anomalous IPC with system_server.
• Ingest mobile device logs into a centralized data lake to baseline normal ResourceTypes usage and surface deviations.

How to Mitigate CVE-2026-0056

Immediate Actions Required

• Apply the Android security patch level 2026-06-01 or later on all affected devices running Android 14, 15, or 16.
• Update Android 16 QPR2 beta participants to the latest beta build that includes the fix.
• Restrict installation of applications from untrusted sources and enforce Google Play Protect on managed devices.
• Inventory devices that cannot be patched and prioritize replacement or isolation.

Patch Information

Google released the fix as part of the Android Security Bulletin June 2026. Devices must report a security patch level of 2026-06-01 or later to be considered remediated. OEMs distribute the patch through standard over-the-air (OTA) updates, and timing varies by vendor and carrier.

Workarounds

• No official workaround exists; vendor patching is the only complete remediation.
• Enforce mobile device management (MDM) policies that block sideloading and restrict app sources to vetted stores.
• Limit access to sensitive enterprise data on devices that have not yet received the June 2026 patch level.

# Verify the Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-06-01 or later