Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
CVE-2026-0021 Cross-User Permission Bypass in http://AppInfoBase.java Leads to Local Privilege Escalation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0021
Post summary
The post announces CVE‑2026‑0021, a cross‑user permission bypass in AppInfoBase.java that allows local privilege escalation, with no mention of PoC, exploit, patch, or active exploitation.
🟠 CVE-2026-0021 - High In hasInteractAcrossUsersFullPermission of http://AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no... https://www.thehackerwire.com/vulnerability/CVE-2026-0021/ https://t.co/2SbM1F8oGF
Post summary
The post announces CVE‑2026‑0021, a high‑severity local privilege escalation via a permission bypass in AppInfoBase.java, but provides no PoC, exploit code, or patch details.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | android | 14.0 | - | - | |
| OS | android | 15.0 | - | - | |
| OS | android | 16.0 | - | - | |
| OS | android | 16.0 | - | - | |
| OS | android | 16.0 | - | - | |
| OS | android | 16.0 | - | - |