CVE-2026-0076: In validateNode of ResourceTypes

Synopsis

An out-of-bounds read vulnerability exists in the validateNode function of ResourceTypes.cpp in Google Android versions 14 through 16-qpr2. The flaw is reachable locally by any low-privilege process and requires no user interaction to trigger. Successful exploitation gives an attacker full local privilege escalation, allowing them to read, modify, or destroy data as a privileged system user. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient; no admin or elevated permissions are needed before exploitation.

• Victim interactionNot required

  No user interaction of any kind is required; the attacker can trigger the flaw entirely from their own process.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or specific memory layout requirements needed.

Blast Radius

• Attacker gains full read access to memory regions and files beyond their privilege level, including credential stores and protected system data.
• Attacker gains write access to privileged system state, allowing persistent modification of configuration, binaries, or stored application data.
• Attacker can crash or destabilize privileged system services, disrupting device operation.
• Combined confidentiality, integrity, and availability impact means a successful attacker effectively controls the device at a system level.