CVE-2026-0118: Google Android Privilege Escalation Flaw

CVE-2026-0118 Overview

CVE-2026-0118 is a privilege escalation vulnerability affecting Google Android's oobconfig component. The flaw stems from a logic error that enables attackers to bypass carrier restrictions, potentially leading to local escalation of privilege without requiring any additional execution privileges or user interaction.

Critical Impact

Local privilege escalation vulnerability in Android that can be exploited without user interaction to bypass carrier-enforced security restrictions and gain elevated system access.

Affected Products

• Google Android (all versions without the March 2026 security patch)
• Google Pixel devices running vulnerable Android versions
• Android devices from OEM partners prior to receiving the security update

Discovery Timeline

• 2026-03-10 - CVE-2026-0118 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-0118

Vulnerability Analysis

The vulnerability exists within the oobconfig component of Android, which is responsible for handling out-of-box configuration including carrier-specific settings and restrictions. A logic error in this component allows malicious actors to circumvent carrier-enforced security policies without requiring elevated privileges or user interaction.

The flaw enables local privilege escalation, meaning an attacker with local access to a device could exploit this vulnerability to gain higher system privileges. The attack can be performed without any user interaction, making it particularly dangerous in scenarios where devices may be left unattended or in compromised environments.

Root Cause

The root cause is classified under CWE-693 (Protection Mechanism Failure). The oobconfig component contains a logic error that fails to properly enforce carrier restriction checks. This protection mechanism failure allows the normal security controls intended to limit device functionality based on carrier policies to be bypassed entirely.

The logic flaw likely occurs during the validation or enforcement phase of carrier restrictions, where conditional checks may be improperly ordered, use incorrect comparison operators, or fail to account for edge cases that an attacker could leverage.

Attack Vector

This is a local attack vector vulnerability. An attacker requires local access to the Android device to exploit this flaw. The exploitation does not require:

• Additional execution privileges
• User interaction
• Network connectivity

The attack proceeds by triggering the logic error in oobconfig to bypass carrier restrictions, which then enables the attacker to escalate privileges on the device. Since no user interaction is required, the attack could be automated or performed silently in the background.

Due to the nature of this vulnerability, the exploitation mechanism involves triggering the flawed logic path in the oobconfig component. Detailed technical analysis can be found in the Android Security Bulletin March 2026.

Detection Methods for CVE-2026-0118

Indicators of Compromise

• Unexpected changes to carrier restriction settings or device provisioning state
• Anomalous activity in oobconfig related system logs or processes
• Unauthorized modification of carrier-locked configurations or APN settings
• Suspicious privilege escalation attempts originating from system configuration components

Detection Strategies

• Monitor Android system logs for unusual oobconfig component activity or errors
• Implement mobile device management (MDM) solutions to detect configuration tampering
• Deploy endpoint detection and response (EDR) solutions capable of monitoring Android system processes
• Audit device provisioning states for unauthorized changes to carrier restrictions

Monitoring Recommendations

• Enable verbose logging for carrier configuration and provisioning components
• Implement real-time alerting for privilege escalation attempts on managed Android devices
• Regularly audit device security patch levels to identify unpatched systems
• Monitor for behavioral anomalies in system configuration processes

How to Mitigate CVE-2026-0118

Immediate Actions Required

• Apply the March 2026 Android Security Update immediately to all affected devices
• Verify patch installation through device settings or MDM console
• Prioritize patching for devices in high-security environments or those with sensitive data
• Consider isolating unpatched devices from corporate networks until updates are applied

Patch Information

Google has addressed this vulnerability in the March 2026 Android Security Bulletin. The fix is included in the 2026-03-01 security patch level. Organizations should ensure all Android devices are updated to this patch level or later.

For detailed patch information, refer to:

• Android Security Bulletin March 2026
• Android Pixel Security Bulletin March 2026

Workarounds

• Implement strict physical access controls for Android devices until patches are applied
• Use mobile device management (MDM) policies to restrict local access capabilities
• Enable Android's built-in security features such as verified boot and secure lock screen
• Consider deploying SentinelOne Mobile Threat Defense for enhanced visibility and protection

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch
# Expected output should be 2026-03-01 or later