CVE-2026-0034: Input Validation

Published Mar 2, 2026

Updated

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

6 affected components

Google Android=14.0

Google Android=15.0

Google Android=16.0

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

Mar 2, 2026

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0034?

CVE-2026-0034 has been classified as a medium severity vulnerability due to the potential for local escalation of privilege.

How do I fix CVE-2026-0034?

To remediate CVE-2026-0034, users should update their devices to the latest Android version provided by Google that includes the security patch.

What versions of Android are affected by CVE-2026-0034?

CVE-2026-0034 affects Android versions 14.0, 15.0, and 16.0 including specific beta releases.

Is user interaction required to exploit CVE-2026-0034?

No, user interaction is not needed for the exploitation of CVE-2026-0034.

What type of vulnerability is CVE-2026-0034?

CVE-2026-0034 is a vulnerability related to improper input validation that can lead to notification policy desynchronization.