CVE-2026-0096: In getAppLabel of ForgetDeviceDialogFragment

Synopsis

This is a local privilege escalation vulnerability in the Android Bluetooth settings component, specifically in the getAppLabel method of ForgetDeviceDialogFragment.java. An attacker with a low-privilege local account can exploit a misleading or insufficient UI to trick the system into performing a privileged action, requiring no additional execution privileges. Successful exploitation grants the attacker elevated privileges on the device, with full read, write, and availability impact. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild as soon as upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no admin or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  The CVSS vector specifies UI:N, meaning no user action such as clicking a link or opening a file is required for exploitation.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental prerequisites.

Blast Radius

• The attacker gains elevated privileges on the device, bypassing the normal permission boundary enforced for low-privilege accounts.
• Confidential data stored on the device, including app data, credentials, and session tokens, becomes readable by the attacker.
• The attacker can modify persisted data, system settings, or installed application state.
• The attacker can disrupt or terminate running processes and services on the affected device.