CVE-2026-0091: In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user

Synopsis

This is a local privilege escalation vulnerability in Google Android affecting versions 14, 15, 16, and 16-qpr2. An attacker with a low-privilege shell account on the device can exploit an over-privileged shell user condition in multiple locations to inject and execute code inside the Android launcher process, escalating privileges without requiring any additional permissions or user interaction. Successful exploitation gives the attacker high-level control over the device, including full read access to sensitive data, the ability to modify system state, and the ability to crash or disrupt services. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger the vulnerability.

• AuthenticationRequired

  A low-privilege shell account on the device is sufficient; no admin or elevated credentials are needed beyond that baseline.

• Victim interactionNot required

  No user action, click, or social-engineering step is required for exploitation.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout requirements must be satisfied.

Blast Radius

• The attacker executes arbitrary code inside the Android launcher process, gaining effective control over the device's primary user-facing runtime.
• Confidential data stored on the device, including credentials, session tokens, and application data, becomes readable by the attacker.
• The attacker can modify persisted system state, install software, alter settings, or tamper with data belonging to other applications.
• The attacker can crash or disrupt the launcher and dependent services, causing denial of service to the device user.