CVE-2026-0093: In multiple locations, there is a possible misleading UI due to obfuscation

Synopsis

This vulnerability is a misleading UI (user interface obfuscation) flaw affecting Google Android versions 14, 15, 16, and 16-QPR2. An attacker with a low-privilege local account can exploit it without any user interaction to escalate their privileges on the device. Successful exploitation grants the attacker high-level control over confidentiality, integrity, and availability of the affected system. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to begin exploitation.

• Victim interactionNot required

  No action from another user or victim is required; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required to succeed.

Blast Radius

• Reads sensitive data stored on the device, including credentials, session tokens, and private application data.
• Modifies system files, application data, or device configuration, compromising the integrity of the affected Android installation.
• Disrupts or crashes services running on the device, causing denial of service to applications or system components.
• Gains effective full control of the device at a privilege level beyond the original low-privilege account, enabling persistent access.