CVE-2026-0098: In getCallingPackageName of Shared

Synopsis

A confused deputy vulnerability in the getCallingPackageName function of Shared.java allows a local attacker to bypass activity start restrictions on Android versions 14 through 16-qpr2. The attacker needs only a low-privilege account and local access to the device, with no user interaction required. Successful exploitation grants full escalation of privilege, giving the attacker read, write, and execution control over resources protected by those restrictions. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as Google publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the device is required.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient; no admin or elevated credentials are needed.

• Victim interactionNot required

  The exploit runs without any action from another user on the device.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors must be arranged.

Blast Radius

• Reads files, tokens, and data belonging to other apps or the OS that the attacker's process would normally be blocked from accessing.
• Writes or modifies data and settings protected by activity start restrictions, overwriting content the attacker should not control.
• Executes restricted activities or components as if holding elevated system permissions, enabling further lateral movement within the device.
• Full confidentiality, integrity, and availability of affected subsystems are compromised once the privilege boundary is crossed.