Description
In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-09-08
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

In the HostEmulationManager component of Android, a logic error can cause a flaw that allows an attacker to gain higher privileges locally without requiring any additional execution rights or user interaction. The impact is a local escalation of privilege, giving the attacker greater control over the device.

Affected Systems

The vulnerability affects Android systems that include the HostEmulationManager module, as provided by Google. No specific Android version is listed, so the flaw may be present in multiple releases that contain the implicated functions.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, making it unclear how frequently this flaw has been exploited. The CVSS score of 7.8 indicates a high level of severity, and because the flaw provides local privilege escalation without user interaction, the potential risk is significant, especially in environments where untrusted applications run background tasks.

Generated by OpenCVE AI on September 11, 2026 at 05:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest official Android security patch that fixes HostEmulationManager logic errors when it becomes available.
  • Limit background activity permissions for applications and enforce device administrator policies that restrict host emulation usage to trusted system components.
  • Disable or restrict HostEmulationManager functionality for unfamiliar or untrusted applications via device policy or app restrictions, ensuring only authorized processes can invoke host emulation services.

Generated by OpenCVE AI on September 11, 2026 at 05:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*

Fri, 11 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Title HostEmulationManager Logic Error Allows Local Privilege Escalation in Android

Fri, 11 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Title Logic Error in HostEmulationManager Allows Background Activity Launch and Local Privilege Escalation
Weaknesses CWE-269
CWE-284

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-693
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 10 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Wed, 09 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Title Logic Error in HostEmulationManager Allows Background Activity Launch and Local Privilege Escalation
Weaknesses CWE-269
CWE-284

Tue, 08 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-09-10T15:02:44.549Z

Reserved: 2025-10-15T15:42:18.218Z

Link: CVE-2026-0084

cve-icon Vulnrichment

Updated: 2026-09-10T15:02:40.831Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T19:17:50.067

Modified: 2026-09-15T14:29:54.637

Link: CVE-2026-0084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T06:00:10Z

Weaknesses
  • CWE-693

    Protection Mechanism Failure