CVE-2026-0078: In setGlobalProxy of DevicePolicyManagerService

Synopsis

A privilege escalation vulnerability exists in the setGlobalProxy function of Android's DevicePolicyManagerService. An attacker with a low-privilege local account can exploit improper input validation that causes a desync in persistence, requiring no user interaction and no elevated permissions beyond a basic account. Successful exploitation gives the attacker full read, write, and execution control over the affected device process. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no admin or elevated credentials are needed beyond a basic user session.

• Victim interactionNot required

  No user interaction is required; the attacker can execute the exploit entirely without involving another user.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layout, or specific environmental state is required.

Blast Radius

• The attacker gains full read access to sensitive data held by the affected process, including credentials, session tokens, and device policy state.
• The attacker can write or overwrite persisted configuration and policy data, altering device proxy settings and potentially broader system state.
• The attacker achieves local privilege escalation, gaining execution capabilities beyond their original permission level on the device.
• All three impact dimensions (confidentiality, integrity, availability) are rated High, meaning the attacker has complete control over the affected component.