CVE-2026-57042 Overview
CVE-2026-57042 is a permission bypass vulnerability in the Android DreamPickerReceiver.kt component. Multiple functions within the component contain a confused deputy flaw that allows a privileged local caller to bypass permission checks. Successful exploitation results in local privilege escalation with System execution privileges. The vulnerability requires no user interaction. Google addressed the issue in the Android Security Bulletin for September 2026.
Critical Impact
A local attacker with existing high privileges can escalate to System-level execution on affected Android devices without any user interaction.
Affected Products
- Android (component: DreamPickerReceiver.kt)
- Refer to the Android Security Bulletin September 2026 for the specific device and build coverage
Discovery Timeline
- 2026-09-15 - CVE-2026-57042 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-57042
Vulnerability Analysis
The vulnerability resides in multiple functions of DreamPickerReceiver.kt, a broadcast receiver associated with Android's dream (screensaver) picker functionality. The component acts on behalf of a caller without adequately verifying whether the caller holds the permissions required to perform the requested action. This mismatch between the receiver's own privileges and the calling identity produces a confused deputy condition classified as [CWE-441]. An attacker able to reach the receiver can direct it to invoke privileged operations that the attacker's own context is not authorized to perform. The exploitation path is entirely local and requires no user interaction, and the attacker gains execution at the System privilege level on the device.
Root Cause
The root cause is improper delegation of privilege inside DreamPickerReceiver.kt. The receiver executes privileged operations in its own security context but does not correctly propagate or check the caller's identity and permissions. This class of flaw, tracked as [CWE-441] Unintended Proxy or Intermediary (Confused Deputy), lets a lower-privileged actor influence a higher-privileged component into acting on its behalf.
Attack Vector
Exploitation requires local access with high privileges already on the device. An attacker in that position can craft an intent or broadcast that reaches DreamPickerReceiver, causing it to perform actions the attacker could not perform directly. Because the receiver holds System-level authority, the outcome is code execution or state changes with System privileges. No user interaction is required, which makes the flaw suitable as a stepping stone in a larger local exploit chain. See the Android Security Bulletin September 2026 for the vendor's technical description.
No verified public proof-of-concept code is available at the time of writing.
Detection Methods for CVE-2026-57042
Indicators of Compromise
- Unexpected broadcasts or intents targeting DreamPickerReceiver originating from non-system applications or shell contexts
- Processes running with System UID that were spawned or influenced by user-installed applications
- Modifications to dream (screensaver) configuration performed without a corresponding user-driven Settings interaction
Detection Strategies
- Review MDM and Android EDR telemetry for intent traffic directed at com.android.systemui receivers associated with dream selection
- Correlate application install and execution events with subsequent privileged configuration changes on the device
- Compare device build fingerprints against the patched security patch level published in the September 2026 Android Security Bulletin
Monitoring Recommendations
- Ingest Android device logs and MDM compliance events into a centralized analytics platform to baseline normal receiver activity
- Alert on privilege escalation patterns where a non-system caller precedes System-context operations
- Track fleet-wide Android security patch level and flag devices below the September 2026 patch level
How to Mitigate CVE-2026-57042
Immediate Actions Required
- Apply the September 2026 Android security patch level or later to all managed devices
- Prioritize patching for devices that host sensitive workloads or run untrusted third-party applications
- Enforce MDM policies that block installation of unvetted applications until patching completes
Patch Information
Google fixed CVE-2026-57042 in the September 2026 Android Security Bulletin. Devices with a security patch level of 2026-09-01 or later contain the fix for the affected DreamPickerReceiver.kt functions. Consult the Android Security Bulletin September 2026 for the specific patch references and device build mappings.
Workarounds
- No official vendor workaround is documented; patching to the September 2026 security patch level is the supported remediation
- Restrict installation of untrusted applications through enterprise mobility management until affected devices receive the patch
- Monitor devices that cannot receive the update promptly and consider isolating them from sensitive data access
# Verify the Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
