CVE-2026-0071: In SettingsLib, there is a possible missing permission check due to a logic error in the code

Synopsis

A missing permission check in Android's SettingsLib component allows a local attacker to escalate privileges without any additional account permissions or user interaction. The logic error in the code means that a process or app already running on the device can invoke privileged operations that should be gated behind a permission check. Successful exploitation gives the attacker full control over the affected Android device, including access to sensitive data, the ability to modify system state, and the ability to disrupt services. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger the missing permission check.

• AuthenticationNot required

  No account credentials or elevated privileges are needed; any unprivileged app or process already running on the device is sufficient to exploit the flaw.

• Victim interactionNot required

  The exploit runs entirely within the attacker-controlled process and does not require the device owner or any other user to take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, memory-layout assumptions, or other environmental preconditions.

Blast Radius

• A successful attacker gains privileged execution on the Android device, bypassing the permission model that normally restricts sensitive operations.
• The attacker reads protected system data and sensitive user data stored on the device, including credentials, contacts, and app data.
• The attacker modifies system settings, installs software, and alters persisted data across the device.
• The attacker can crash or disable system services, causing a denial of service to the device and its running applications.