CVE-2026-0072: In addInputMethodListener of com

Synopsis

A missing permission check in the Android XR InputMethodManagerService allows an unprivileged application to register as an input method listener without any authorization. The vulnerability is reachable over the network according to the CVSS v4.0 vector, requires no authentication, and needs no user interaction. Successful exploitation grants full read and write access to data on the device and can disrupt service availability. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The CVSS v4.0 vector specifies AV:N, meaning the attacker must be able to reach the affected service over the network to deliver the exploit.

• AuthenticationNot required

  PR:N indicates no account or credentials are needed; an anonymous or unprivileged caller can trigger the missing permission check directly.

• Victim interactionNot required

  UI:N confirms that no user action such as clicking a link or opening a file is required for exploitation to succeed.

• Attack complexityDetail

  AC:L means the exploit is reliable and condition-free, with no race conditions or specific memory layout requirements necessary.

Blast Radius

• Reads confidential data stored on the device, including session tokens, credentials, and user records (VC:H).
• Writes or modifies persisted data and system state on the device (VI:H).
• Crashes or disrupts the affected service on the device (VA:H).
• Compromises confidentiality, integrity, and availability of components beyond the immediate application scope, including system-level resources (SC:H, SI:H, SA:H).