Race Condition Vulnerability in Android Device Policy Manager
CVE-2026-59020

Currently unrated

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
2 November 2026

What is CVE-2026-59020?

A vulnerability exists in the Android Device Policy Manager due to a race condition in the removeUserData function of DevicePolicyManagerService.java. This flaw may allow a local attacker with user execution privileges to cause a denial of service. Exploitation does not require user interaction, potentially leading to a disruption of service.

Affected Version(s)

Android 17

Android 16-qpr2

Android 16

References

https://source.android.com/docs/security/bulletin/2026/20...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.