CVE-2026-0077: In resumeConfigurationDispatch of ActivityRecord

Synopsis

This is a local privilege escalation vulnerability in the Android window manager component, specifically in the resumeConfigurationDispatch method of ActivityRecord.java. An attacker with a low-privilege local account can exploit a logic error to launch background applications without authorization, bypassing Android's background activity launch restrictions. Successful exploitation grants full read, write, and execution control over the affected device without requiring any user interaction. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Google publishes a fix for Android 16-QPR2.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative credentials are needed.

• Victim interactionNot required

  The exploit executes entirely without any action from a logged-in user or other victim.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layouts, or environmental prerequisites are required.

Blast Radius

• Attacker gains full read access to files, credentials, and application data belonging to other users or system processes on the device.
• Attacker gains full write access, allowing modification or deletion of system files, application data, and persisted configuration.
• Attacker achieves code execution at an elevated privilege level by launching arbitrary background applications outside normal Android launch controls.
• The combination of high confidentiality, integrity, and availability impact means the attacker can fully compromise or render inoperable the affected Android instance.