CVE-2026-0063: In setAllowedCarriers of PhoneInterfaceManager

Synopsis

A privilege escalation vulnerability exists in the setAllowedCarriers method of PhoneInterfaceManager.java in Android 17. A logic error in the carrier restriction enforcement code allows an attacker to disable carrier lock controls, reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives the attacker full read, write, and availability impact on both the affected component and connected system components. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network; an attacker does not need local or physical access to the device.

• AuthenticationNot required

  No account credentials or prior privileges are needed to reach the vulnerable code path.

• Victim interactionNot required

  Exploitation completes without any action from a user on the targeted device.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are required.

Blast Radius

• Attacker disables carrier restrictions on the targeted Android device, enabling unauthorized SIM or carrier changes.
• Full read access to sensitive data on the affected component gives the attacker access to stored credentials, messages, and device identifiers.
• Full write access allows the attacker to modify system configuration, install unauthorized carrier profiles, or alter device policy settings.
• Availability of both the local component and connected system components can be fully disrupted, effectively bricking carrier-dependent functionality or causing service outages.