Local Privilege Escalation in Android's ActivityRecord Component

CVE-2026-0077

What is CVE-2026-0077?

A local privilege escalation vulnerability exists in the resumeConfigurationDispatch function of ActivityRecord.java. Due to a logic error, applications may inadvertently launch in the background without the user’s knowledge or consent. This vulnerability can be exploited without requiring additional execution privileges or user interaction, potentially leading to unauthorized access and actions within the system.

References