CVE-2026-0015
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In multiple locations of AppOpsService.java, improper input validation allows a possible persistent denial of service. Exploitation requires only local access, with no additional execution privileges and no user interaction.
Risk Assessment
May cause a persistent denial of service on an Android device by a local attacker. Affects availability of system services and may require a device restart.
Recommendation
Update Android to a version containing the input validation fix in AppOpsService.java. Apply security updates provided by the device vendor.
Other vulnerabilities in Android
See all- CVE-2016-0833High
Android allows users to cause a denial of service.
- CVE-2026-58876Critical
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-58868Critical
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-28606Critical
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2025-48595HighActively exploited
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
- CVE-2025-48626Critical
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2025-48572HighActively exploited
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2024-32896HighActively exploited
The vulnerability is due to a logic error in the code that allows bypassing security controls. It could lead to local escalation of privilege with no additional execution privileges needed, but user interaction is required for exploitation.
- CVE-2023-35674HighActively exploited
In onCreate of WindowState.java, there is a logic error that allows launching a background activity. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2023-21237MediumActively exploited
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Original NVD description (English source)
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS