CVE-2026-0047: High severity Google Android vulnerability

Published Mar 2, 2026

Updated

In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

3 affected components

Google Android=16.0-qpr2_beta_1

Google Android=16.0-qpr2_beta_2

Google Android=16.0-qpr2_beta_3

Event History

Mar 2, 2026

CVE Published

via MITRE·06:43 PM

Data Sourced

via MITRE·06:43 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0047?

CVE-2026-0047 is classified as a critical vulnerability that allows local escalation of privilege.

How do I fix CVE-2026-0047?

To fix CVE-2026-0047, ensure that your affected Android version is updated to a secure release that addresses this vulnerability.

What versions of Android are affected by CVE-2026-0047?

CVE-2026-0047 affects Google Android versions 16.0-qpr2_beta_1, 16.0-qpr2_beta_2, and 16.0-qpr2_beta_3.

What kind of exploitation is possible with CVE-2026-0047?

CVE-2026-0047 allows an app to access private information without user interaction, due to a missing permission check.

Is user interaction required for exploiting CVE-2026-0047?

No, user interaction is not needed for the exploitation of CVE-2026-0047.