CVE-2026-0087: In approvalLevelForDomainInternal of DomainVerificationService

Synopsis

This is a privilege-escalation vulnerability in Android's DomainVerificationService, specifically in the approvalLevelForDomainInternal function. A local attacker with a low-privilege account can exploit a logic error to hijack arbitrary app links, redirecting intent traffic meant for a legitimate app to a malicious one, without needing elevated permissions or any action from the device user. Successful exploitation gives the attacker full read, write, and execution control at the compromised privilege level, enabling data theft, data tampering, and potential further compromise of the device. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient; no admin or elevated permissions are needed beyond a basic user session.

• Victim interactionNot required

  The exploit completes without any action from the device owner or any other user on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layouts, or environmental factors need to be arranged.

Blast Radius

• Reads app-link intent data routed through the hijacked domain handler, exposing tokens, credentials, or personal information passed between apps via deep links.
• Modifies or intercepts in-flight intent payloads, allowing the attacker to tamper with data before the legitimate target app receives it.
• Redirects authentication callbacks and OAuth redirect URIs to a malicious app, enabling account takeover without the user noticing.
• Gains the full combined read, write, and code-execution surface of the impersonated app's permission set on the device.