CVE-2026-0153: In Write of msg_to_host_buffer

Synopsis

An out-of-bounds write vulnerability exists in the Android kernel, specifically in the Write function of msg_to_host_buffer.cc, where an incorrect bounds check allows memory to be written past the end of an intended buffer. The flaw is reachable locally by any low-privilege process already running on the device, with no user interaction required. Successful exploitation gives an attacker full escalation of privilege on the affected host. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable code is required.

• AuthenticationRequired

  Any low-privilege account or process context on the device is sufficient; no elevated or admin credentials are needed.

• Victim interactionNot required

  The exploit executes entirely within the attacker-controlled process; no action by another user is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layouts, or environmental dependencies are noted in the CVSS scoring.

Blast Radius

• Attacker gains full kernel-level privileges on the compromised device, overriding all process isolation boundaries.
• Confidential data stored on the device, including credentials, session tokens, and application data, becomes readable by the attacker.
• The attacker can write or modify any data on the device, including system files, application state, and persisted records.
• The attacker can crash or destabilize the kernel, taking the device or containerized workload offline.