CVE-2026-0091: Google Android Privilege Escalation Flaw

CVE-2026-0091 Overview

CVE-2026-0091 is a local privilege escalation vulnerability affecting multiple versions of Google Android. The flaw exists in multiple locations within the operating system where an over-privileged shell user can execute code in the launcher process. Successful exploitation allows a local attacker to elevate privileges without requiring additional execution permissions or user interaction. The vulnerability is tracked under [CWE-269: Improper Privilege Management] and impacts Android versions 14, 15, and 16, including the QPR2 beta builds. Google addressed the issue in the Android Security Bulletin June 2026.

Critical Impact

A local attacker with shell-level access can execute code within the launcher process, leading to privilege escalation that compromises confidentiality, integrity, and availability of the device.

Affected Products

• Google Android 14.0
• Google Android 15.0
• Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)

Discovery Timeline

• 2026-06-01 - Google publishes the Android Security Bulletin addressing CVE-2026-0091
• 2026-06-01 - CVE-2026-0091 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-0091

Vulnerability Analysis

The vulnerability stems from improper privilege management across multiple components in the Android operating system. The shell user — typically used for debugging and Android Debug Bridge (ADB) operations — holds permissions broader than required, enabling it to influence or execute code in the launcher process context. Because the launcher process operates at a higher privilege level than the shell user, an attacker bridging this gap gains elevated capabilities. The flaw is local in nature, requires low complexity to exploit, and does not require user interaction.

Root Cause

The root cause is over-privileged shell user permissions in multiple locations within the Android framework. The shell user account has access rights or interfaces that allow influencing the launcher process — a behavior that violates the principle of least privilege. This privilege management failure aligns with [CWE-269] and creates a pathway from a less-trusted execution context to a more-trusted one.

Attack Vector

An attacker must first obtain local shell-level access to the device. This is typically achievable through ADB connections, malicious applications that hold the shell user identity in restricted configurations, or post-compromise scenarios. Once local access is established, the attacker leverages the over-privileged shell interfaces to inject or trigger code execution within the launcher process. Because the launcher operates with elevated permissions, this results in privilege escalation. Google has not published technical exploitation details. Refer to the Android Security Bulletin June 2026 for component-level information.

Detection Methods for CVE-2026-0091

Indicators of Compromise

• Unexpected processes spawned by or interacting with the Android launcher process from a shell user context.
• ADB sessions or shell-uid processes invoking launcher-related Inter-Process Communication (IPC) or intents outside normal debugging workflows.
• Anomalous changes to launcher configuration, components, or persistence artifacts on managed devices.

Detection Strategies

• Monitor mobile device management (MDM) telemetry for devices running unpatched Android 14, 15, or 16 builds.
• Inspect logcat and audit logs for shell-user activity that touches launcher process boundaries.
• Identify devices where ADB or shell access is enabled in production environments, as these expose the local attack surface.

Monitoring Recommendations

• Enroll mobile devices in an enterprise mobility management platform that reports patch level and shell/ADB state.
• Alert on the introduction of new applications requesting shell-adjacent permissions or developer-mode toggles.
• Correlate device patch level against the June 2026 Android Security Bulletin to identify exposed endpoints.

How to Mitigate CVE-2026-0091

Immediate Actions Required

• Apply the June 2026 Android security patch level to all Android 14, 15, and 16 devices in scope.
• Disable ADB and developer mode on production and corporate-managed devices to reduce local attack surface.
• Audit installed applications and remove untrusted software that could obtain local shell context.

Patch Information

Google released fixes for CVE-2026-0091 in the Android Security Bulletin June 2026. Devices reporting a security patch level of 2026-06-01 or later contain the fix. Original equipment manufacturers (OEMs) distribute the patch on their own schedules, so verify availability through the device vendor.

Workarounds

• Restrict physical and network access to devices that cannot be patched immediately.
• Enforce policies that block enabling USB debugging on managed Android endpoints.
• Use MDM compliance rules to quarantine devices running pre-June 2026 patch levels until they update.