Local Privilege Escalation in ActivityManagerService of Android
CVE-2026-0047

8.4HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
2 March 2026

What is CVE-2026-0047?

The vulnerability found in the dumpBitmapsProto method of ActivityManagerService.java allows a malicious application to bypass necessary permission checks, potentially granting it unauthorized access to sensitive user information. This flaw does not require any additional execution privileges or user interaction for exploitation, posing a significant security risk for devices operating on unpatched versions of Android.

Affected Version(s)

Android 16-qpr2

References

https://source.android.com/docs/security/bulletin/2026/20...
vendor-advisory

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.