Description
In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-09-15
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a permission bypass in DreamPickerReceiver.kt that allows a confused deputy to grant an app System execution privileges. An attacker with local device access can run privileged code without any user interaction.

Affected Systems

Google Android OS. No specific versions are identified in the advisory.

Risk and Exploitability

The CVSS score is 6.7, indicating medium severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires no user interaction and is fully local, making it attractive for attackers but the low EPSS indicates it is not widely exploited at present.

Generated by OpenCVE AI on September 20, 2026 at 13:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Android security patch that addresses the DreamPickerReceiver permission bypass.
  • If a patch is not available, revoke or limit permissions for the DreamPickerReceiver component or related apps using the Android permission manager.
  • As a temporary measure, disable or uninstall any third‑party launchers or components that expose the vulnerable DreamPickerReceiver until the official fix is released.

Generated by OpenCVE AI on September 20, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Title DreamPickerReceiver Permission Bypass Enables Local Privilege Escalation

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

Thu, 17 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Permission Bypass in Android DreamPickerReceiver
Weaknesses CWE-277
CWE-284

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Wed, 16 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-441
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Permission Bypass in Android DreamPickerReceiver
Weaknesses CWE-277
CWE-284

Tue, 15 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Tue, 15 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: Google_Devices

Published:

Updated: 2026-09-17T03:56:28.659Z

Reserved: 2026-06-23T16:28:17.723Z

Link: CVE-2026-57042

cve-icon Vulnrichment

Updated: 2026-09-16T13:12:11.448Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T19:17:30.930

Modified: 2026-09-18T17:31:02.010

Link: CVE-2026-57042

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T13:30:17Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')