CVE-2026-0015: Input Validation

Published Mar 2, 2026

Updated

In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

6 affected components

Google Android=14.0

Google Android=15.0

Google Android=16.0

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

Mar 2, 2026

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0015?

CVE-2026-0015 has a medium severity level due to its potential to cause a persistent denial of service.

How do I fix CVE-2026-0015?

To fix CVE-2026-0015, ensure you update your Android device to the latest security patch that addresses this vulnerability.

Which versions of Android are affected by CVE-2026-0015?

CVE-2026-0015 affects Android versions 14.0, 15.0, and 16.0 including specific QPR beta releases.

Can CVE-2026-0015 be exploited remotely?

No, CVE-2026-0015 requires local access and user interaction is not needed for exploitation.

What causes CVE-2026-0015?

CVE-2026-0015 is caused by improper input validation in the AppOpsService.java file.