In DevicePolicyManagerService, the setGlobalProxy API contains a desynchronization flaw caused by inadequate input validation. The flaw allows a local application to write a privileged proxy configuration that is not properly persisted, resulting in a privilege escalation that requires no extra execution rights and does not require user interaction.

Google Android devices are affected. Specific Android releases are not enumerated in the advisory; any device running the version of DevicePolicyManagerService that contains the vulnerable code before the 2026‑06‑01 security update is potentially impacted.

The vulnerability can be exploited locally by any application that can invoke setGlobalProxy. No user interaction or elevated privileges are necessary. The EPSS score is <1%, indicating a low likelihood of exploitation. The CVSS score of 5.9 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog, but the lack of defense‑in‑depth and the high potential impact mean that the risk is significant. A successful exploitation gives the attacker the ability to modify proxy settings and potentially gain higher system privileges.