CVE-2026-0072General(google / android_xr)

LOWCVSS 7.8 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • android_xr

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 3 classified signals
  • Disclosure: 1 classified signal
  • Peaked at 3 mentions on most recent observed day (2026-06-08)
  • 4 total mentions across 2 days

Affected systems

Vendors
Products
android_xr

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-06-01: 1Mentions · 2026-06-08: 3Technical Details · 2026-06-08: 106-0106-08
Signal classification2 categories
General
375.0%
Disclosure
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-011
Disclosure1
2026-06-083
General3
Full discourse4 posts
  • ゆぅさん@YY20424277
    General

    【3軸解説】「GoogleのAndroid XRにおける認可に関する脆弱性(CVE-2026-0072)」を、背景 / 目的 / 効果 の 3 軸で読み解きます。 背景/目的/効果の3軸で読み解きました。 #セキュリティ #若手コンサル ▶ note メンバーシップ: https://note.com/yuusan_security/membership

    Post summary

    The post references CVE-2026-0072 but offers only a high-level, 3-axis discussion without providing technical details, patches, or evidence of exploitation.

    0001071
    868 followersView on X
  • ゆぅさん@YY20424277
    General

    もし自分の現場で「GoogleのAndroid XRにおける認可に関する脆弱性(CVE-2026-0072)」が起きたら、最初の一手は何ですか? →背景/目的/効果の3軸でfirst-stepを整理しました。 #セキュリティ #インシデント対応 ▶ 無料ツール WR-Analysis: https://www.intect-i.jp/tools/wr-analysis/

    Post summary

    The post asks what the first step should be if CVE-2026-0072 occurs and links a free analysis tool, but provides no evidence of exploitation or remediation.

    0001073
    868 followersView on X
  • ゆぅさん@YY20424277
    General

    「GoogleのAndroid XRにおける認可に関する脆弱性(CVE-2026-0072)」をボードに上げるなら1ページでどう書く? 背景/目的/効果の3軸で要約しました。 #セキュリティ #経営報告 ▶ 無料プログラム: https://www.intect-i.jp/local-program/

    Post summary

    The text is a query about how to summarize CVE‑2026‑0072 on a board, providing only a generic description of an authorization vulnerability in Android XR, without any technical detail, PoC, exploit code, or patch information.

    0000059
    868 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    A new vulnerability with increased severity was disclosed for Google Android XR (CVE-2026-0072) https://vuldb.com/vuln/367712

    Post summary

    A new vulnerability (CVE-2026-0072) affecting Google Android XR has been disclosed with an increased severity, as noted at the provided vulnerability database link.

    0000072
    2.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
OSgoogleandroid_xr14--

Explore more