CVE-2026-0099: In onNullBinding of HostEmulationManager

Synopsis

A privilege escalation flaw exists in the Android HostEmulationManager component, specifically in its onNullBinding handler. An attacker with a low-privilege local account can exploit a logic error to launch an activity from the background, bypassing normal restrictions. Successful exploitation grants full read, write, and execution control over the affected device without requiring any elevated permissions. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no admin or elevated credentials are needed.

• Victim interactionRequired

  A user must interact with the device (for example, tapping or otherwise engaging with a UI element) for the background activity launch to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads sensitive data stored on the device, including files and credentials accessible to the targeted process.
• Modifies application data, device settings, or persisted storage under the control of the escalated context.
• Executes arbitrary actions at an elevated privilege level, enabling installation of malicious components or further lateral movement within the device.
• Disrupts normal device operation by terminating or hijacking foreground activities and system services.